Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4e32c1bf0cea8a3…

MALICIOUS

PDF

40.9 KB Created: 2018-12-14 20:00:57 +03:00 Authoring application: Word (via Mac OS X 10.7.5 Quartz PDFContext)
MD5: 1e1e4cca9f836cf3c8212b38ecf1bef6 SHA-1: 9211a815c96ba0cd1fd1a20a0365beb27e61a8ee SHA-256: f4e32c1bf0cea8a3e4b7d0501a7114eec8f65ddec70ff5bd0e82ed5346ec2414
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or SEO manipulation tactic. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of embedded URLs points to a malicious intent, likely to redirect users to malicious sites or distribute further malware. The document body was heavily truncated and did not provide further context.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9002

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/qu-cosas-dice-mi-abuela-spanish-language-edition-of-the.pdf
    • http://www.gorillawalker.com/organo-di-metallic-compounds-or-reagents-synergistic-effects-and-synthetic.pdf
    • http://www.gorillawalker.com/chandragomin-s-twenty-verses-on-the-bodhisattva-vow.pdf
    • http://www.gorillawalker.com/a-car-cia-essencial-uma-psicologia-do-afeto.pdf
    • http://www.gorillawalker.com/the-gifts-of-god-1st-edition-a-course-in-miracles.pdf
    • http://www.gorillawalker.com/the-30-minute-vegan-s-taste-of-europe-150-plant.pdf
    • http://www.gorillawalker.com/by-herbert-f-wolf-color-atlas-of-dental-hygiene-periodontology.pdf
    • http://www.gorillawalker.com/stop-renting-start-buying-8-steps-to-buying-a-home.pdf
    • http://www.gorillawalker.com/bioinformatics-a-practical-guide-to-the-analysis-of-genes-and.pdf
    • http://www.gorillawalker.com/big-spring-ranch-brides-katrina-orphan-train-romance-book-5.pdf
    • http://www.gorillawalker.com/glencoe-french-2-bon-voyage-french-edition.pdf
    • http://www.gorillawalker.com/a-wanted-man-a-jack-reacher-novel-book-17-unabridged.pdf
    • http://www.gorillawalker.com/lsat-logic-games-by-type-volume-2-all-80-analytical.pdf
    • http://www.gorillawalker.com/the-ultimate-country-fake-book-5th-edition.pdf
    • http://www.gorillawalker.com/managing-healthcare-information-systems-with-web-enabled-technologies.pdf
    • http://www.gorillawalker.com/how-to-build-big-inch-gm-ls-series-engines-sa.pdf
    • http://www.gorillawalker.com/your-health-is-your-choice.pdf
    • http://www.gorillawalker.com/the-home-planet.pdf
    • http://www.gorillawalker.com/common-butterflies-of-singapore-kindle-edition.pdf
    • http://www.gorillawalker.com/cruising-through-life-kindle-edition.pdf
    • http://www.gorillawalker.com/law-and-public-education-cases-and-materials-kindle-edition.pdf
    • http://www.gorillawalker.com/polygraphies-francophone-women-writing-algeria.pdf
    • http://www.gorillawalker.com/ag-transition-in-ny-state-95-henry-a-wallace-series.pdf
    • http://www.gorillawalker.com/chronology-of-transportation-in-the-united-states.pdf
    • http://www.gorillawalker.com/on-the-road-down-girl-and-sit-series.pdf
    • http://www.gorillawalker.com/sesame-street-volume-3-abby-s-first-day-of-school.pdf
    • http://www.gorillawalker.com/beckett-in-the-theatre-the-author-as-practical-playwright-and.pdf
    • http://www.gorillawalker.com/the-southwest-airlines-way.pdf
    • http://www.gorillawalker.com/undergoing-god-dispatches-from-the-scene-of-a-break-in.pdf
    • http://www.gorillawalker.com/c2-re-envisioned-the-future-of-the-enterprise.pdf
    • http://www.gorillawalker.com/the-complete-works-of-zhuangzi-translations-from-the-asian-classics.pdf
    • http://www.gorillawalker.com/ana-bolena-la-reina-consorte-por-la-que-enrique-viii.pdf
    • http://www.gorillawalker.com/ferrari-250-gto-the-history-of-a-legend.pdf
    • http://www.gorillawalker.com/journal-of-a-residence-on-a-georgian-plantation-1838-1839.pdf
    • http://www.gorillawalker.com/javier-ayarza-terra.pdf
    • http://www.gorillawalker.com/accidentals-on-purpose-a-musician-s-dictionary.pdf
    • http://www.gorillawalker.com/sleepers-super-bolan-88.pdf
    • http://www.gorillawalker.com/brain-games-kids-ps-write-and-erase-activity-cards.pdf
    • http://www.gorillawalker.com/mel-bay-presents-modern-guitar-method-grade-1-playing-chords.pdf
    • http://www.gorillawalker.com/navigating-your-spouse-s-midlife-crisis-a-trip-to-hell.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.