Malicious PDF — malware analysis report

Static analysis result for SHA-256 f290b866dffb8214…

MALICIOUS

PDF

42.2 KB Created: 2018-12-15 08:53:25 +03:00 Authoring application: Microsoft Word: LaserWriter 8 8.6.5 (via Acrobat Distiller 4.0 for Macintosh)
MD5: a61ebf1ad5fb97a873e6f9b112fa88e3 SHA-1: ff246fa710c188dca39d9d748037422e3552ee33 SHA-256: f290b866dffb8214b0041d14014952e565433f911aa95c17ebc4162d45cedf31
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links pointing to a single domain, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or to distribute a large volume of content, potentially malicious. The ML classifier also flagged the PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/la-gu-a-b-blica-para-la-liberaci-n-spanish.pdf
    • http://www.gorillawalker.com/the-impact-of-tablet-pcs-and-pen-based-technology-on.pdf
    • http://www.gorillawalker.com/chef-interrupted-discovering-life-s-second-course-in-ireland-with.pdf
    • http://www.gorillawalker.com/on-the-art-of-the-no-drama-the-major-treatises.pdf
    • http://www.gorillawalker.com/the-mathematical-work-of-john-wallis-ams-chelsea-publishing.pdf
    • http://www.gorillawalker.com/langenscheidt-s-standard-turkish-dictionary-turkish-english-english-turkish.pdf
    • http://www.gorillawalker.com/recent-developments-on-reliability-maintenance-and-safety-wit-transactions-on.pdf
    • http://www.gorillawalker.com/this-is-hybrid-english-and-spanish-edition.pdf
    • http://www.gorillawalker.com/belief-attitude-intention-and-behavior-an-introduction-to-theory-and.pdf
    • http://www.gorillawalker.com/joan-sebastian-las-canciones-de-piano-vocal-guitar-artist-songbook.pdf
    • http://www.gorillawalker.com/birth-of-the-vampire-the-vanderlind-realm-book-1-kindle.pdf
    • http://www.gorillawalker.com/a-doctor-s-vietnam-journal-militaryb-monograph.pdf
    • http://www.gorillawalker.com/black-trivia-the-african-american-experience-a-to-z-our.pdf
    • http://www.gorillawalker.com/on-ayer-wadsworth-notes.pdf
    • http://www.gorillawalker.com/nursing-school-study-pack-drug-reference-labs-mnemonics-ekg-4.pdf
    • http://www.gorillawalker.com/amante-vengado-vii-la-hermandad-de-la-daga-negra-black.pdf
    • http://www.gorillawalker.com/keys-to-music-rudiments-students-workbook-no-4.pdf
    • http://www.gorillawalker.com/27-recetas-f.pdf
    • http://www.gorillawalker.com/diet-and-nutrition-with-a-special-focus-on-swimming-and.pdf
    • http://www.gorillawalker.com/best-of-london-lonely-planet-pocket-guide-london.pdf
    • http://www.gorillawalker.com/to-the-navel-of-the-world-yaks-and-unheroic-travels.pdf
    • http://www.gorillawalker.com/caleb-morgan-seven-brothers-for-mcbride-7-siren-publishing-everlasting.pdf
    • http://www.gorillawalker.com/antisocial-personality-disorder-an-epidemiological-perspective.pdf
    • http://www.gorillawalker.com/alte-und-neue-gronlandische-fischerei-und-wallfischfang-german-edition.pdf
    • http://www.gorillawalker.com/more-good-questions-great-ways-to-differentiate-secondary-mathematics-instruction.pdf
    • http://www.gorillawalker.com/the-dice-of-fate.pdf
    • http://www.gorillawalker.com/seamus-heaney-and-medieval-poetry.pdf
    • http://www.gorillawalker.com/ten-fun-things-to-do-in-south-portland.pdf
    • http://www.gorillawalker.com/the-encyclopedia-of-country-living-40th-anniversary-edition-the-original.pdf
    • http://www.gorillawalker.com/the-ten-commandments-laws-that-liberate-new-community-bible-study.pdf
    • http://www.gorillawalker.com/the-secret-history-of-hermes-trismegistus-hermeticism-from-ancient-to.pdf
    • http://www.gorillawalker.com/light-and-plant-growth-topics-in-plant-physiology.pdf
    • http://www.gorillawalker.com/the-objects-of-thought.pdf
    • http://www.gorillawalker.com/kashmir-ethnic-conflict-international-dispute.pdf
    • http://www.gorillawalker.com/ferrets-2015-square-12x12-multilingual-edition.pdf
    • http://www.gorillawalker.com/10-woodland-sketches-op-51-selections-nos-1-5-for.pdf
    • http://www.gorillawalker.com/better-drums-with-rockschool-grade-6.pdf
    • http://www.gorillawalker.com/project-cost-estimating.pdf
    • http://www.gorillawalker.com/finding-the-cure.pdf
    • http://www.gorillawalker.com/music-minus-one-sousaphone-tuba-or-bass-new-orleans-classics.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.