Malicious PDF — malware analysis report

Static analysis result for SHA-256 039c6f4bf2561ba2…

MALICIOUS

PDF

42.7 KB Created: 2018-11-26 08:23:35 +03:00 Authoring application: - (via Acrobat Distiller 7.0 (Windows))
MD5: 0ce6a31e90ee1b185361137c081e05a9 SHA-1: fdb04fa0c3f2a63051e0ab17155f67d8a84d6f77 SHA-256: 039c6f4bf2561ba2a88eb03d36ddc138ea66ce940a08918725521ba09a321dca
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links to external PDF files, primarily hosted on 'gorillawalker.com'. This behavior is indicative of a link farm or a method to distribute potentially malicious content indirectly. The ML classifier also flagged this PDF as malicious, supporting the suspicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/attaching-in-adoption-practical-tools-for-today-s-parents.pdf
    • http://www.gorillawalker.com/a-meeting-in-the-bushes-kindle-edition.pdf
    • http://www.gorillawalker.com/the-problem-of-catalan.pdf
    • http://www.gorillawalker.com/science-fiction-contemporary-mythology-the-sfwa-sfra-anthology.pdf
    • http://www.gorillawalker.com/all-together-now-records-instructions-and-wishes-for-those-you.pdf
    • http://www.gorillawalker.com/the-elements-of-java-tm-style-sigs-reference-library-kindle.pdf
    • http://www.gorillawalker.com/piano-quartet-no-1-in-g-minor-op-25-movement.pdf
    • http://www.gorillawalker.com/precious-little.pdf
    • http://www.gorillawalker.com/the-daniel-fast-workbook-a-5-week-guide-for-individuals.pdf
    • http://www.gorillawalker.com/sachse-one-hundred-studies-for-trumpet-schrimer-s-library-of.pdf
    • http://www.gorillawalker.com/elijah-s-disneyland-park-2015-the-ultimate-guide-elijah-s.pdf
    • http://www.gorillawalker.com/finding-shelter.pdf
    • http://www.gorillawalker.com/beer-tap-into-the-art-and-science-of-brewing-hardback.pdf
    • http://www.gorillawalker.com/spanish-society-1400-1600.pdf
    • http://www.gorillawalker.com/graff-s-textbook-of-urinalysis-and-body-fluids.pdf
    • http://www.gorillawalker.com/black-death.pdf
    • http://www.gorillawalker.com/the-diary-of-helena-morley.pdf
    • http://www.gorillawalker.com/madam-secretary-a-memoir-signed-first-edition.pdf
    • http://www.gorillawalker.com/a-grammar-of-the-latin-language-for-the-use-of.pdf
    • http://www.gorillawalker.com/the-shaping-of-western-civilization-volume-i-from-antiquity-to.pdf
    • http://www.gorillawalker.com/working-the-pivot-points-to-make-america-work-again-frank.pdf
    • http://www.gorillawalker.com/walter-beeler-method-for-the-bb-flat-tuba-walter-beeler.pdf
    • http://www.gorillawalker.com/the-ascension-rays-book-five-manifestation.pdf
    • http://www.gorillawalker.com/the-economics-of-gambling-and-national-lotteries-international-library-of.pdf
    • http://www.gorillawalker.com/american-lafrance-700-and-800-series-1953-1958-photo-archive.pdf
    • http://www.gorillawalker.com/lying-eyes-siren-publishing.pdf
    • http://www.gorillawalker.com/the-definitive-personal-assistant-and-secretarial-handbook-a-best-practice.pdf
    • http://www.gorillawalker.com/differential-equations-student-solutions-manual-graphics-models-data.pdf
    • http://www.gorillawalker.com/walleyed-pike-fish-game.pdf
    • http://www.gorillawalker.com/spherical-trigonometry-for-the-use-of-colleges-and-schools-with.pdf
    • http://www.gorillawalker.com/human-molecular-genetics-by-strachan-tom-read-andrew-garland-science.pdf
    • http://www.gorillawalker.com/important-symbols-in-their-hebrew-pagan-and-christian-forms.pdf
    • http://www.gorillawalker.com/buddhism-50-buddhist-teachings-for-happiness-spiritual-healing-and-enlightenment.pdf
    • http://www.gorillawalker.com/fort-worth-s-legendary-landmarks.pdf
    • http://www.gorillawalker.com/cello-scales-arpeggios-grades-1-5-abrsm-sight-reading.pdf
    • http://www.gorillawalker.com/never-stop-kindle-edition.pdf
    • http://www.gorillawalker.com/delta-a-general-system-for-processing-taxonomic-descriptions-primer.pdf
    • http://www.gorillawalker.com/emily-goes-wild.pdf
    • http://www.gorillawalker.com/men-masculinities-travel-and-tourism-genders-and-sexualities-in-the.pdf
    • http://www.gorillawalker.com/art-history-5th-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.