Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe9bf378331d6aa1…

MALICIOUS

PDF

40.4 KB Created: 2019-01-06 08:03:11 +03:00 Authoring application: PScript5.dll Version 5.2 (via GPL Ghostscript 8.15)
MD5: 7ca9e51766ff5cd6605c0be8f2c05291 SHA-1: 1f704e4c473a3356d85c6228c8a4021f3c458989 SHA-256: fe9bf378331d6aa1a5877bb1ac7c5f6d1fcb074fabd2c5cabb59d8e1c8bb1fae
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious with high confidence. The primary purpose appears to be hosting a link farm, likely to manipulate search engine rankings or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/america-at-the-threshold-of-destiny.pdf
    • http://www.gorillawalker.com/moon-pennsylvania-moon-handbooks.pdf
    • http://www.gorillawalker.com/ed-and-kip-i-like-to-read.pdf
    • http://www.gorillawalker.com/easy-classical-viola-solos-japanese-edition.pdf
    • http://www.gorillawalker.com/texas-land-on-contrast.pdf
    • http://www.gorillawalker.com/cal-99-horses-calendar-16-month-calendar.pdf
    • http://www.gorillawalker.com/splash-of-colors-the-self-destruction-of-braniff-international.pdf
    • http://www.gorillawalker.com/midnight-a-mckenna-chronicle.pdf
    • http://www.gorillawalker.com/an-der-strasse-von-malakka-ein-botschafter-erlebt-singapur-brunei.pdf
    • http://www.gorillawalker.com/clojure-data-structures-and-algorithms-cookbook.pdf
    • http://www.gorillawalker.com/teacher-s-manual-adventures-for-readers-book-2.pdf
    • http://www.gorillawalker.com/unfaithful-music-disappearing-ink.pdf
    • http://www.gorillawalker.com/bondassage-kinky-erotic-massage-tips-for-lovers.pdf
    • http://www.gorillawalker.com/mathematica-for-physics-2nd-edition.pdf
    • http://www.gorillawalker.com/elements-of-mathematics-general-topology-pt-1.pdf
    • http://www.gorillawalker.com/carole-the-inside-story-saddle-club-r.pdf
    • http://www.gorillawalker.com/my-greek-kitchen.pdf
    • http://www.gorillawalker.com/tree-of-knowledge-tree-of-life.pdf
    • http://www.gorillawalker.com/virtuoso-pianist-in-60-exercises-book-2-piano-technique.pdf
    • http://www.gorillawalker.com/praying-with-moses-a-year-of-daily-prayers-and-reflections.pdf
    • http://www.gorillawalker.com/ingles-completo-repaso-integral-de-gram-tica-inglesa-para-hispanohablantes.pdf
    • http://www.gorillawalker.com/smm7-standard-method-of-measurement-of-building-works.pdf
    • http://www.gorillawalker.com/llama-llama-jingle-bells.pdf
    • http://www.gorillawalker.com/leonard-bernstein-and-his-young-people-s-concerts.pdf
    • http://www.gorillawalker.com/the-medical-detective-john-snow-and-the-mystery-of-cholera.pdf
    • http://www.gorillawalker.com/the-german-arctic-expedition-of-1869-1870.pdf
    • http://www.gorillawalker.com/berlitz-danish-in-60-minutes-berlitz-in-60-minutes-danish.pdf
    • http://www.gorillawalker.com/anthropology-of-childhood-and-youth-international-and-historical-perspectives.pdf
    • http://www.gorillawalker.com/divine-and-moral-songs-for-children-by-isaac-watts.pdf
    • http://www.gorillawalker.com/disfigured-love.pdf
    • http://www.gorillawalker.com/the-process-of-writing-news.pdf
    • http://www.gorillawalker.com/ugly-s-electrical-references-2014-edition.pdf
    • http://www.gorillawalker.com/3-cd-set-to-accompany-listen-6th-edition.pdf
    • http://www.gorillawalker.com/consensuality-didier-anzieu-gender-and-the-sense-of-touch-genus.pdf
    • http://www.gorillawalker.com/counterterrorism-and-open-source-intelligence-lecture-notes-in-social-networks.pdf
    • http://www.gorillawalker.com/unmasked-a-bdsm-erotic-romantic-comedy-novella-room-237-series.pdf
    • http://www.gorillawalker.com/ten-things-you-thought-you-knew-about-golf-clubs.pdf
    • http://www.gorillawalker.com/oceans-untamed-the-shark-shifter-paranormal-romance-book-3.pdf
    • http://www.gorillawalker.com/psychology-of-learning-and-teaching-quest-kindergarten-music-and-dance.pdf
    • http://www.gorillawalker.com/juvenal-and-the-satiric-genre-classical-literature-and-society.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.