Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd2b8b522b51dacf…

MALICIOUS

PDF

32.9 KB Created: 2020-01-17 19:19:35 +03:00 Authoring application: Adobe InDesign CS5.5 (7.5) (via Adobe PDF Library 9.9)
MD5: 77b503df83c6c28a035a311df0122667 SHA-1: b3ece0aab468ee8efd78ce2d23e0c331921ec310 SHA-256: fd2b8b522b51dacf7cff7cdf0b7f348564c3a4412b7cecc635844df198cc1c71
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a large number of embedded external links, characteristic of a link farm or a distribution mechanism for other malicious content. The heuristic PDF_SEO_LINK_FARM specifically identifies the mass external PDF link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/best-loved-hymns-spiritual-songs-for-all-chord-organs-12.pdf
    • http://www.gorillawalker.com/blood-from-your-children-the-colonial-origins-of-generational-conflict.pdf
    • http://www.gorillawalker.com/ghosts-along-the-cumberland-deathlore-in-the-kentucky-foothills.pdf
    • http://www.gorillawalker.com/inside-out-of-my-mind-prose-for-the-recovering-lost.pdf
    • http://www.gorillawalker.com/crossways-a-novel.pdf
    • http://www.gorillawalker.com/cite-checker-your-guide-to-using-the-bluebook-third-edition.pdf
    • http://www.gorillawalker.com/ice-cracker-ii-and-other-short-stories-the-emperor-s.pdf
    • http://www.gorillawalker.com/easy-classical-guitar-alto-recorder-duets-featuring-music-of-bach.pdf
    • http://www.gorillawalker.com/patchwork-peril-an-anastasia-pollack-crafting-mini-mystery-book-3.pdf
    • http://www.gorillawalker.com/fundamentals-of-engineering-thermodynamics-8th-edition-print-replica-kindle-edition.pdf
    • http://www.gorillawalker.com/video-movie-guide-2002.pdf
    • http://www.gorillawalker.com/improvising-better-a-guide-for-the-working-improviser.pdf
    • http://www.gorillawalker.com/analog-days-the-invention-and-impact-of-the-moog-synthesizer.pdf
    • http://www.gorillawalker.com/letterati-an-unauthorized-look-at-scrabble-and-the-people-who.pdf
    • http://www.gorillawalker.com/wings-hesperus-modern-voices.pdf
    • http://www.gorillawalker.com/go-tell-it-on-the-mountain-full-score-john-rutter.pdf
    • http://www.gorillawalker.com/chalk-butterfly-flight-part-three-chalk-butterfly-trilogy-book-3.pdf
    • http://www.gorillawalker.com/white-fur-flying.pdf
    • http://www.gorillawalker.com/international-business-the-challenges-of-globalization-5th-edition.pdf
    • http://www.gorillawalker.com/world-encyclopaedia-of-aero-engines.pdf
    • http://www.gorillawalker.com/governance-and-organizational-dynamics-medical-practice-management-body-of-knowledge.pdf
    • http://www.gorillawalker.com/the-origin-of-tragedy-with-special-reference-to-the-greek.pdf
    • http://www.gorillawalker.com/an-all-consuming-passion-origins-modernity-and-the-australian-life.pdf
    • http://www.gorillawalker.com/ber-ttelser-ur-svenska-historie-volume-45-swedish-edition.pdf
    • http://www.gorillawalker.com/physical-hazard-control-preventing-injuries-in-the-workplace.pdf
    • http://www.gorillawalker.com/ophthalmology-a-brief-review-for-nurses-medical-students-and-ophthalmic.pdf
    • http://www.gorillawalker.com/domainer-s-magazine-issue-11-kindle-edition.pdf
    • http://www.gorillawalker.com/human-virology-3rd-edition.pdf
    • http://www.gorillawalker.com/red-sky-at-night.pdf
    • http://www.gorillawalker.com/the-reflective-cause-2-alpha-warriors-of-the-cause-the.pdf
    • http://www.gorillawalker.com/engineering-design-an-introduction-texas-science.pdf
    • http://www.gorillawalker.com/negotiation-theories-strategies-and-skills.pdf
    • http://www.gorillawalker.com/pocket-guide-to-chicago-architecture.pdf
    • http://www.gorillawalker.com/full-of-changes-a-gay-step-taboo-story-book-2.pdf
    • http://www.gorillawalker.com/what-general-educators-have-to-say-about-successfully-including-students.pdf
    • http://www.gorillawalker.com/remembering-heraclitus.pdf
    • http://www.gorillawalker.com/dream-culture-bringing-dreams-to-life.pdf
    • http://www.gorillawalker.com/wreck-valley-iii-a-record-of-shipwrecks-off-long-island.pdf
    • http://www.gorillawalker.com/15-multiplication-worksheets-with-5-digit-multiplicands-4-digit-multipliers.pdf
    • http://www.gorillawalker.com/performance-indicators-for-water-supply-services.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.