Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9cf9c66adb07320…

MALICIOUS

PDF

41.8 KB Created: 2018-11-23 21:06:37 +03:00 Authoring application: ABBYY FineReader 8.0 Professional Edition
MD5: fc715a62d2deb5bb259972ad6edbbf5d SHA-1: 1f938dcafdb406f2b3f70e5940ef695b6df9c7b9 SHA-256: f9cf9c66adb07320e8a4c209b793323c54646cbc828a1f23cc2e1ec13dbbdbd7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by a machine learning classifier and contains a large number of external links, indicating a potential SEO manipulation or content distribution scheme. The embedded URLs point to various PDF documents hosted on the same domain, suggesting a link farm or a method to distribute further malicious content. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-butterflies-of-scotland-a-natural-history.pdf
    • http://www.gorillawalker.com/cuckold-initiations-bundle-books-1-3.pdf
    • http://www.gorillawalker.com/rebirth-volume-22.pdf
    • http://www.gorillawalker.com/cross-examination-the-art-of-the-advocate.pdf
    • http://www.gorillawalker.com/the-portuguese-columbus-secret-agent-of-king-john-ii.pdf
    • http://www.gorillawalker.com/reworking-race-the-making-of-hawaii-s-interracial-labor-movement.pdf
    • http://www.gorillawalker.com/comprehensive-multicultural-education-theory-and-practice-7th-edition.pdf
    • http://www.gorillawalker.com/mouse-numbers-a-very-first-counting-book.pdf
    • http://www.gorillawalker.com/buzan-s-book-of-genius-and-how-to-unleash-your.pdf
    • http://www.gorillawalker.com/britten-essays-letters-and-opera-guides-hans-keller-archive.pdf
    • http://www.gorillawalker.com/the-nano-experiment-science-fiction-novel-a-genetic-engineering-military.pdf
    • http://www.gorillawalker.com/fall-of-darkness-shore-of-monsters-2-kindle-edition.pdf
    • http://www.gorillawalker.com/development-of-child-and-adolescent-psychiatric-nursing-practice-in-korea.pdf
    • http://www.gorillawalker.com/the-twain-one-kindle-edition.pdf
    • http://www.gorillawalker.com/curtiss-bright-cities-the-hialeah-miami-springs-opa-locka.pdf
    • http://www.gorillawalker.com/secret-pleasures-erotic-pleasures-series-volume-3.pdf
    • http://www.gorillawalker.com/elaboraci-n-artesanal-del-pan-spanish-edition.pdf
    • http://www.gorillawalker.com/field-manual-fm-3-09-fire-support-november-2011-kindle.pdf
    • http://www.gorillawalker.com/prudence-the-custard-protocol.pdf
    • http://www.gorillawalker.com/2-zhi-early-modern-hen-volume-8-japan-buddhism-history.pdf
    • http://www.gorillawalker.com/the-lord-s-supper-kindle-edition.pdf
    • http://www.gorillawalker.com/let-evening-come-for-soprano-viola-and-piano.pdf
    • http://www.gorillawalker.com/the-planets-los-planetas-powerkids-readers-the-universe-el-universo.pdf
    • http://www.gorillawalker.com/gemmotherapy-and-oligotherapy-regenerators-of-dying-intoxicated-cells-tridosha-of.pdf
    • http://www.gorillawalker.com/grandmaster-chess-move-by-move-john-nunn-applies-the-move.pdf
    • http://www.gorillawalker.com/squeaky-clean-unique-newborn-baby-rubdown-squeaky-clean-coloured-interior.pdf
    • http://www.gorillawalker.com/united-states-catholic-catechism-for-adults.pdf
    • http://www.gorillawalker.com/the-ridiculous-race.pdf
    • http://www.gorillawalker.com/30-christmas-carols-with-sheet-music-and-fingering-for-tin.pdf
    • http://www.gorillawalker.com/1001-questions-answered-about-earthquakes-avalanches-floods-and-other-natural.pdf
    • http://www.gorillawalker.com/learning-at-home-sticker-activity-time-early-learning-sticker-activity.pdf
    • http://www.gorillawalker.com/joshua-and-aaron-itp-book-two-kindle-edition.pdf
    • http://www.gorillawalker.com/killing-the-cobra-chinatown-trollop-felix-gomez.pdf
    • http://www.gorillawalker.com/handbook-of-textile-design-principles-processes-and-practice.pdf
    • http://www.gorillawalker.com/the-worlds-of-a-maasai-warrior-an-autobiography.pdf
    • http://www.gorillawalker.com/vaccine-approved-for-prostate-cancer-men-s-health-an-article.pdf
    • http://www.gorillawalker.com/stories-from-puerto-rico-legends-of.pdf
    • http://www.gorillawalker.com/the-sorrows-of-young-werther-modern-library.pdf
    • http://www.gorillawalker.com/jimmy-s-blues-and-other-poems.pdf
    • http://www.gorillawalker.com/on-war-all-volumes.pdf
    • http://www.gorillawalker.com/buzan-s-book-of-genius-and-how-to-unl
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.