Malicious PDF — malware analysis report

Static analysis result for SHA-256 f69ca1f7ab6bbbe6…

MALICIOUS

PDF

41.0 KB Created: 2018-12-11 20:45:22 +03:00 Authoring application: FrameMaker 10.0.2 (via Acrobat Distiller 9.5.5 (Windows))
MD5: 2290094bb7dabb702c95c191b70feecb SHA-1: a355ccc7751cc81d75b2773822b6b2c17e944609 SHA-256: f69ca1f7ab6bbbe63d9845470c59f5a402c2cec9e0e327bcf0c9285ffc28a62c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or distribute additional malicious content via the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/gourmet-dog-biscuits-a-cookbook-of-tasty-treats-for-your.pdf
    • http://www.gorillawalker.com/the-treasury-of-knowledge-book-8-part-3-the-elements.pdf
    • http://www.gorillawalker.com/the-wisdom-wit-of-sarah-palin-an-empty-headed-volume.pdf
    • http://www.gorillawalker.com/strong-smart-and-bold-empowering-girls-for-life-foreword-by.pdf
    • http://www.gorillawalker.com/standing-on-my-head-life-lessons-in-contradictions-prather-hugh.pdf
    • http://www.gorillawalker.com/hydrogen-peroxide-and-aloe-vera-plus-other-home-remedies.pdf
    • http://www.gorillawalker.com/the-everything-glycemic-index-cookbook-300-appetizing-recipes-to-keep.pdf
    • http://www.gorillawalker.com/aris-gets-grossed-out-arcadia-park.pdf
    • http://www.gorillawalker.com/national-security-intelligence.pdf
    • http://www.gorillawalker.com/mae-jemison-space-pioneer-fact-finders-biographies-great-african-americans.pdf
    • http://www.gorillawalker.com/photosynthetic-excitons.pdf
    • http://www.gorillawalker.com/bollywood-desires.pdf
    • http://www.gorillawalker.com/tannhauser-march-sheet-music.pdf
    • http://www.gorillawalker.com/little-black-book-des-poker-little-black-books-deutsche-ausgabe.pdf
    • http://www.gorillawalker.com/nick-der-weltraumfahrer-nick-1-german-edition.pdf
    • http://www.gorillawalker.com/western-press-coverage.pdf
    • http://www.gorillawalker.com/apprendre-l-italien-dition-bilingue-fran-ais-italien-l-histoire.pdf
    • http://www.gorillawalker.com/the-big-payback-the-history-of-the-business-of-hip.pdf
    • http://www.gorillawalker.com/classic-works-in-rf-engineering.pdf
    • http://www.gorillawalker.com/cosa-nostra-a-history-of-the-sicilian-mafia.pdf
    • http://www.gorillawalker.com/5-steps-to-a-5-ap-macroeconomics-2016-5-steps.pdf
    • http://www.gorillawalker.com/song-of-the-summer-king-book-i-of-the-summer.pdf
    • http://www.gorillawalker.com/control-systems-engineering-3rd-edition.pdf
    • http://www.gorillawalker.com/harem-of-passion-the-battered-lamp-4-genie-harem-polygamy.pdf
    • http://www.gorillawalker.com/sugar-sporties-twenty-to-make-of-paula-macleod-on-11.pdf
    • http://www.gorillawalker.com/clinical-companion-for-assessment-of-the-older-adult.pdf
    • http://www.gorillawalker.com/i-know-my-alphabet-jelly-bear.pdf
    • http://www.gorillawalker.com/cognitive-behavioral-therapy-cbt-how-to-overcome-phobias-addictions-depression.pdf
    • http://www.gorillawalker.com/tourism-monograph-of-nepal-kindle-edition.pdf
    • http://www.gorillawalker.com/the-political-campaign-desk-reference-a-guide-for-campaign-managers.pdf
    • http://www.gorillawalker.com/die-walk-re-wwv-86b-act-iii-sc-1-ritt.pdf
    • http://www.gorillawalker.com/masterchef-tm-the-ultimate-cookbook.pdf
    • http://www.gorillawalker.com/backcountry-whistler-map.pdf
    • http://www.gorillawalker.com/count-down-the-race-for-beautiful-solutions-at-the-international.pdf
    • http://www.gorillawalker.com/collected-stories-of-william-faulkner.pdf
    • http://www.gorillawalker.com/how-to-stop-smoking-and-stay-stopped-for-good.pdf
    • http://www.gorillawalker.com/instant-cashflow-instant-success.pdf
    • http://www.gorillawalker.com/psychiatric-drugs-explained-6e.pdf
    • http://www.gorillawalker.com/evaluation-of-human-work.pdf
    • http://www.gorillawalker.com/the-liberty-colouring-book.pdf
    • http://www.gorillawalker.com/hydrogen-peroxide-and-aloe-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.