Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5cc55aa77010627…

MALICIOUS

PDF

40.6 KB Created: 2018-12-14 20:04:44 +03:00 Authoring application: Adobe PageMaker 7.0 (via Acrobat Distiller 5.0.5 for Macintosh)
MD5: fe967a2ed0ffe4ead63d6b9acac67870 SHA-1: 39eceb6ca455fae7639aa4f5a737bf2fe423f0d1 SHA-256: f5cc55aa77010627781fddb82b2a0b94b1fc2d7422817e536ddb8bf6f4989b27
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a significant number of embedded external links, characteristic of a link farm or redirection tactic. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 32 external links, suggesting the document's purpose is to distribute traffic to various other PDF resources, likely as a lure or to host malicious content indirectly. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/3-minute-devotions-for-girls-180-inspirational-readings-for-young.pdf
    • http://www.gorillawalker.com/flirt-volume-one-the-art-of-naughty.pdf
    • http://www.gorillawalker.com/a-b-c-d-e-f-g-i-love-the.pdf
    • http://www.gorillawalker.com/vehicle-noise-and-vibration-refinement-woodhead-publishing-in-mechanical-engineering.pdf
    • http://www.gorillawalker.com/craps-by-the-numbers.pdf
    • http://www.gorillawalker.com/miocene-and-oligocene-petroleum-reservoirs-of-the-santa-maria-santa.pdf
    • http://www.gorillawalker.com/the-miserable-tome-iii-marius.pdf
    • http://www.gorillawalker.com/wiley-the-auditor-s-sas-field-guide-2001.pdf
    • http://www.gorillawalker.com/on-the-growth-rate-of-reef-corals-and-its-relation.pdf
    • http://www.gorillawalker.com/rituximab-an-entry-from-thomson-gale-s-gale-encyclopedia-of.pdf
    • http://www.gorillawalker.com/the-texas-chain-saw-massacre-companion.pdf
    • http://www.gorillawalker.com/f-is-for-flag-reading-railroad.pdf
    • http://www.gorillawalker.com/selected-poems-a-calderbook-cb435-pt-2.pdf
    • http://www.gorillawalker.com/summer-sports-camps-101-a-guidebook-for-development-and-operation.pdf
    • http://www.gorillawalker.com/wild-cards-4-el-viaje-de-los-ases-spanish-edition.pdf
    • http://www.gorillawalker.com/john-keats-the-making-of-a-poet.pdf
    • http://www.gorillawalker.com/laminated-thailand-map-by-borch-english-edition.pdf
    • http://www.gorillawalker.com/l-arbre-de-vie-symbole-de-la-spiritualit.pdf
    • http://www.gorillawalker.com/piano-sonata-no-14-second-movement-moonlight-sonata-easy-intermediate.pdf
    • http://www.gorillawalker.com/mac-application-development-by-example-beginner-s-guide.pdf
    • http://www.gorillawalker.com/transnational-legal-problems-materials-and-text-university-casebook-series-english.pdf
    • http://www.gorillawalker.com/implementing-auditing-procedures.pdf
    • http://www.gorillawalker.com/the-highest-place-love-s-story-told-for-satb-choir.pdf
    • http://www.gorillawalker.com/the-child-abuse-survivor-project.pdf
    • http://www.gorillawalker.com/hms-sheffield-the-life-and-times-of-old-shiny.pdf
    • http://www.gorillawalker.com/gray-s-english-poems-original-and-translated-from-the-norse.pdf
    • http://www.gorillawalker.com/federal-income-taxation-hornbook-series-student-edition.pdf
    • http://www.gorillawalker.com/a-man-called-harris-the-life-of-richard-harris.pdf
    • http://www.gorillawalker.com/daddy-was-an-exorcist.pdf
    • http://www.gorillawalker.com/geriatric-cardiology-principles-and-practice.pdf
    • http://www.gorillawalker.com/urban-planning-in-a-changing-world-the-twentieth-century-experience.pdf
    • http://www.gorillawalker.com/old-trafford-behind-the-scenes-manchester-united-official-pocket-books.pdf
    • http://www.gorillawalker.com/million-dollar-slots.pdf
    • http://www.gorillawalker.com/managing-legal-services-mis-report.pdf
    • http://www.gorillawalker.com/knowledge-management-for-services-operations-and-manufacturing-chandos-knowledge-management.pdf
    • http://www.gorillawalker.com/did-man-just-happen.pdf
    • http://www.gorillawalker.com/hb-a-sub-1c-goals-for-children-too-strict-experts.pdf
    • http://www.gorillawalker.com/mail-order-mama-brides-of-beckham-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/estates-and-wills-all-you-want-to-know-without-the.pdf
    • http://www.gorillawalker.com/a-study-in-darkness-book-two-in-the-baskerville-affair.pdf
    • http://www.gorillawalker.com/on-the-growth-rate-of-reef-corals-and-its-rel
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.