Malicious PDF — malware analysis report

Static analysis result for SHA-256 f33f56ffe2ff4047…

MALICIOUS

PDF

41.9 KB Created: 2019-03-18 12:11:37 +03:00 Authoring application: LaTeX with hyperref and pdfscreen (via Mac OS X 10.5.7 Quartz PDFContext)
MD5: 2e99adf382bc73f57718eb289169bda1 SHA-1: 6901e43f6ddc28395662f213648d0c4395bf6b05 SHA-256: f33f56ffe2ff40479f08c693a5c966512a46bb49c25c6d3c711444d6a730b4bf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. The primary attack pattern appears to be a link farm, likely intended to drive traffic to external sites, potentially for SEO manipulation or to serve further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/myths-of-babylonia-and-assyria-forgotten-books.pdf
    • http://www.gorillawalker.com/backyard-bugs-floor-puzzle.pdf
    • http://www.gorillawalker.com/the-seasons-vocal-score-new-english-german.pdf
    • http://www.gorillawalker.com/did-senator-larry-campbell-reveal-the-true-sentiment-of-rcmp.pdf
    • http://www.gorillawalker.com/super-grains-seeds.pdf
    • http://www.gorillawalker.com/mrcp-examination-part-2-a-candidate-s-revision-notes-masterpass.pdf
    • http://www.gorillawalker.com/henry-sidgwick-later-utilitarian-political-philosophy.pdf
    • http://www.gorillawalker.com/lautr-amont-bachelard-translations.pdf
    • http://www.gorillawalker.com/history-report-the-d-r-miller-farm.pdf
    • http://www.gorillawalker.com/art-design-a-source-book.pdf
    • http://www.gorillawalker.com/curious-cats-and-digging-dogs.pdf
    • http://www.gorillawalker.com/the-nhs-beginning-middle-and-end-the-autobiography-of-dr.pdf
    • http://www.gorillawalker.com/smiles-to-go.pdf
    • http://www.gorillawalker.com/what-are-people-for-essays.pdf
    • http://www.gorillawalker.com/yiannopoulos-civil-law-property-coursebook-2011-supplement.pdf
    • http://www.gorillawalker.com/screenwriting-for-film-television-by-miller-william-1997-paperback.pdf
    • http://www.gorillawalker.com/the-adult-years-mastering-the-art-of-self-renewal.pdf
    • http://www.gorillawalker.com/michael-bolton-greatest-hits-1985-1995-piano-vocal-guitar.pdf
    • http://www.gorillawalker.com/fund-air-pollution-engineering.pdf
    • http://www.gorillawalker.com/what-color-is-my-world-kindle-edition.pdf
    • http://www.gorillawalker.com/the-mystery-of-2012-predictions-prophecies-and-possibilities.pdf
    • http://www.gorillawalker.com/tar-baby-maxnotes-literature-guides.pdf
    • http://www.gorillawalker.com/the-land-hero-of-1812-or-campaigning-with-general-jackson.pdf
    • http://www.gorillawalker.com/turning-the-brat-into-a-bimbo.pdf
    • http://www.gorillawalker.com/laws-of-puerto-rico-annotated-title-30-mortgage-law-and.pdf
    • http://www.gorillawalker.com/children-and-pollution-why-scientists-disagree.pdf
    • http://www.gorillawalker.com/south-american-adventures-pitman-s-travel-series.pdf
    • http://www.gorillawalker.com/how-personal-injury-lawyers-assist-claim-kindle-edition.pdf
    • http://www.gorillawalker.com/maine-atlas-gazetteer.pdf
    • http://www.gorillawalker.com/century-21-computer-applications-keyboarding.pdf
    • http://www.gorillawalker.com/star-force-rescue-sf71-star-force-origin-series.pdf
    • http://www.gorillawalker.com/chronicle-financial-aid-guide-for-1993-94-school-year.pdf
    • http://www.gorillawalker.com/del-texto-a-la-accion-ensayos-de-hermeneutica-ii-spanish.pdf
    • http://www.gorillawalker.com/could-i-have-this-dance-piano-vocal-sheet-music.pdf
    • http://www.gorillawalker.com/cosmetic-product-testing-a-modern-psychophysical-approach-cosmetic-science-and.pdf
    • http://www.gorillawalker.com/bericht-ber-neuere-untersuchungen-und-probleme-aus-der-theorie-der.pdf
    • http://www.gorillawalker.com/eastern-tour-to-the-holy-land-syria-and-the-great.pdf
    • http://www.gorillawalker.com/the-werwolf-on-eagle-s-nest-mountain-a-snowboarding-adventure.pdf
    • http://www.gorillawalker.com/shooting-stands-of-eastern-massachusetts-1929.pdf
    • http://www.gorillawalker.com/sierra-challenge-the-construction-of-the-chihuahua-al-pacifico-railroad.pdf
    • http://www.gorillaw
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.