Malicious PDF — malware analysis report

Static analysis result for SHA-256 0222e4e88063554a…

MALICIOUS

PDF

42.6 KB Created: 2019-04-09 05:36:23 +03:00 Authoring application: TeX (via pdfTeX-0.14h)
MD5: b1ffc65a3a9fb9798b8599fe3b5e58aa SHA-1: 41f6653907715fff1343af62233b2e8e2f6e71d4 SHA-256: 0222e4e88063554a289099992c49b0a1cc1186f81c6a878cc061f5eeee2a51be
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links, forming a link farm. These links point to various PDF documents on the domain 'gorillawalker.com'. The document body contains obfuscated content, but the embedded URLs are clearly visible and suggest a tactic to drive traffic or potentially distribute further malicious content. The primary technique observed is the use of a malicious attachment to lead users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/hydrology-and-water-supply-for-pond-aquaculture.pdf
    • http://www.gorillawalker.com/haiku-cats-haiku-cat-poems-from-a-very-mystical-cat.pdf
    • http://www.gorillawalker.com/the-stonekeeper-s-curse-amulet-2.pdf
    • http://www.gorillawalker.com/computational-cardiology-modeling-of-anatomy-electrophysiology-and-mechanics-lecture-notes.pdf
    • http://www.gorillawalker.com/magistrates-and-pioneers.pdf
    • http://www.gorillawalker.com/the-invisibles-a-tale-of-the-eunuchs-of-india.pdf
    • http://www.gorillawalker.com/praise-israel-for-wisdom-and-instruction-essays-on-ben-sira.pdf
    • http://www.gorillawalker.com/chosen-an-erotic-adventure.pdf
    • http://www.gorillawalker.com/chow-chow-being-selections-from-a-journal-kept-in-india.pdf
    • http://www.gorillawalker.com/deep-dish-lies-kindle-edition.pdf
    • http://www.gorillawalker.com/compliance-the-dilemma-of-the-chronically-ill.pdf
    • http://www.gorillawalker.com/biblical-greek-exegesis.pdf
    • http://www.gorillawalker.com/passtrak-series-52-principles-practices-questions-answers-municipal-securities-representative.pdf
    • http://www.gorillawalker.com/jerusalem-city-of-mirrors.pdf
    • http://www.gorillawalker.com/timed-readings-plus-book-9.pdf
    • http://www.gorillawalker.com/the-woman-who-saved-the-children-a-biography-of-eglantyne.pdf
    • http://www.gorillawalker.com/public-theology-and-the-challenge-of-feminism-gender-theology-and.pdf
    • http://www.gorillawalker.com/shakespeare-and-laughter-a-cultural-history.pdf
    • http://www.gorillawalker.com/common-sense-the-crisis-other-writings-from-the-american-revolution.pdf
    • http://www.gorillawalker.com/george-s-garden-english-chinese-senses-series.pdf
    • http://www.gorillawalker.com/the-abcs-of-violin-for-the-budding-virtuoso-book-5.pdf
    • http://www.gorillawalker.com/up-from-dragons-the-evolution-of-human-intelligence.pdf
    • http://www.gorillawalker.com/kudzu-chaos.pdf
    • http://www.gorillawalker.com/de-baanwachter-zedenschets-dutch-edition.pdf
    • http://www.gorillawalker.com/microsoft-transact-sql-the-definitive-guide.pdf
    • http://www.gorillawalker.com/the-2011-2016-outlook-for-multiple-sclerosis-therapeutics-in-greater.pdf
    • http://www.gorillawalker.com/moscow-spring.pdf
    • http://www.gorillawalker.com/brazil-dropping-in-on.pdf
    • http://www.gorillawalker.com/the-fleet-kindle-edition.pdf
    • http://www.gorillawalker.com/special-use-vehicles-an-illustrated-history-of-unconventional-cars-and.pdf
    • http://www.gorillawalker.com/unequal-worlds-discrimination-and-social-inequality-in-modern-india.pdf
    • http://www.gorillawalker.com/train-experience-the-evolution-of-rail-travel.pdf
    • http://www.gorillawalker.com/fuel-cells-an-introduction-to-electrochemistry.pdf
    • http://www.gorillawalker.com/electricity-and-magnetism-smartphysics-paperback-2011-author-gary-gladding-mats.pdf
    • http://www.gorillawalker.com/exotic-options-a-guide-to-the-second-generation-options.pdf
    • http://www.gorillawalker.com/the-digital-writing-workshop.pdf
    • http://www.gorillawalker.com/americans-from-the-caribbean-and-central-america-new-americans.pdf
    • http://www.gorillawalker.com/wiley-practitioner-s-guide-to-gaas-2002-covering-all-sass.pdf
    • http://www.gorillawalker.com/viaje-al-asombroso-mundo-de-los-hongos-la-ciencia-para.pdf
    • http://www.gorillawalker.com/kindertransport-nick-hern-books.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.