Malicious PDF — malware analysis report

Static analysis result for SHA-256 efb9b290c43db71f…

MALICIOUS

PDF

32.6 KB Created: 2020-02-08 18:42:20 +03:00 Authoring application: - (via Multivalent Merge)
MD5: 40e2b42ab4da7b8955a6344e6381249b SHA-1: c7f911e764ca5634f818990d61ef4133061b6f61 SHA-256: efb9b290c43db71ff1524665392dba594f75162f9a26ccf8e5e48d863ceed4a8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or SEO poisoning attack, where the goal is to drive traffic to a specific set of URLs. The ML classifier also flagged the document as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/fear-of-falling.pdf
    • http://www.gorillawalker.com/the-challenges-of-knowledge-sharing-in-practice-a-social-approach.pdf
    • http://www.gorillawalker.com/limpieza-hepatica-y-de-la-vesicula-bymoritz.pdf
    • http://www.gorillawalker.com/colonial-pathologies-american-tropical-medicine-race-and-hygiene-in-the.pdf
    • http://www.gorillawalker.com/the-shakers-american-religious-experience.pdf
    • http://www.gorillawalker.com/my-lost-mexico.pdf
    • http://www.gorillawalker.com/black-nancy-the-black-nancy-book-series.pdf
    • http://www.gorillawalker.com/judaism-in-music-and-other-essays.pdf
    • http://www.gorillawalker.com/fly-away-fear-overcoming-your-fear-of-flying-karnac-self.pdf
    • http://www.gorillawalker.com/cantata-no-73-herr-wie-du-willt-so-schicks-mir.pdf
    • http://www.gorillawalker.com/forbidden-chocolate-1-ravishing-lisa.pdf
    • http://www.gorillawalker.com/made-easy-junior-kindergarten-math-science-spelling-language.pdf
    • http://www.gorillawalker.com/my-first-book-of-shapes-god-s-way-board-book.pdf
    • http://www.gorillawalker.com/the-first-humans-a-prehistoric-guide.pdf
    • http://www.gorillawalker.com/critical-theory-essential-read-paragon-issues-in-philosophy.pdf
    • http://www.gorillawalker.com/state-of-the-union-webster-s-turkish-thesaurus-edition-paperback.pdf
    • http://www.gorillawalker.com/institutional-governance-and-regulation-of-water-services.pdf
    • http://www.gorillawalker.com/wie-die-libelle-in-der-wasserwaage-german-edition.pdf
    • http://www.gorillawalker.com/linux-robotics-programming-smarter-robots-tab-electronics.pdf
    • http://www.gorillawalker.com/living-a-better-life-after-prostate-cancer-a-survivor-s.pdf
    • http://www.gorillawalker.com/throws-and-takedowns-for-sambo-judo-jujitsu-and-submission-grappling.pdf
    • http://www.gorillawalker.com/retribution-a-time-travel-suspense-novel-city-of-god-book.pdf
    • http://www.gorillawalker.com/a-legacy-for-living-systems-gregory-bateson-as-precursor-to.pdf
    • http://www.gorillawalker.com/nemea-a-guide-to-the-site-and-museum-paperback.pdf
    • http://www.gorillawalker.com/secrets-of-a-sparrow.pdf
    • http://www.gorillawalker.com/pkg-peds-nsg-durham-mat-newborn-nsg-2e-2-volume.pdf
    • http://www.gorillawalker.com/kids-care-75-ways-to-make-a-difference-for-people.pdf
    • http://www.gorillawalker.com/eight-black-horses-87th-precinct-series-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/death-in-the-silent-places.pdf
    • http://www.gorillawalker.com/acupuncture-the-interpretation-of-meridians-and-collaterals-therapy-in-chinese.pdf
    • http://www.gorillawalker.com/how-to-handle-cyberbullies-explorer-library-information-explorer-kindle-edition.pdf
    • http://www.gorillawalker.com/adios-america-the-left-s-plan-to-turn-our-country.pdf
    • http://www.gorillawalker.com/the-ottoman-empire-and-european-capitalism-1820-1913-trade-investment.pdf
    • http://www.gorillawalker.com/the-skull-volume-3-functional-and-evolutionary-mechanisms.pdf
    • http://www.gorillawalker.com/maryland-smith.pdf
    • http://www.gorillawalker.com/diagnostic-medical-sonography-obstetrics-gynecology-diagnostic-medical-sonography-series.pdf
    • http://www.gorillawalker.com/retire-happy-what-you-can-do-now-to-guarantee-a.pdf
    • http://www.gorillawalker.com/gale-encyclopedia-of-alternative-medicine-pain-html-digital.pdf
    • http://www.gorillawalker.com/akasha-chronik-one-true-love-der-praktische-leitfaden-um-das.pdf
    • http://www.gorillawalker.com/joy-of-cooking-all-about-chicken.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.