Malicious PDF — malware analysis report

Static analysis result for SHA-256 07602c0e3aeff2f4…

MALICIOUS

PDF

41.8 KB Created: 2018-11-26 20:03:27 +03:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 5.0.5 (Windows))
MD5: d8101dc34aef8a3bf8cc2b61efd6f59e SHA-1: 888337cc1aae3bc9b96a3e7f4cd3a94f2e2b1b42 SHA-256: 07602c0e3aeff2f4a0d608939423068a21d4943fa00a7aeec43a40da3394a0c1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a large collection of documents hosted on 'gorillawalker.com', which could be for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-brief-history-of-video-games.pdf
    • http://www.gorillawalker.com/rose-wildflowers-of-montana-book-1.pdf
    • http://www.gorillawalker.com/riza-shah-pahlavi-the-resurrection-and-reconstruction-of-iran-1878.pdf
    • http://www.gorillawalker.com/music-success-in-nine-weeks-a-step-by-step-guide.pdf
    • http://www.gorillawalker.com/100-cph-eat-every-hour-and-lose-weight.pdf
    • http://www.gorillawalker.com/the-non-designer-s-design-book-3rd-edition-non-designer.pdf
    • http://www.gorillawalker.com/picture-of-dorian-gray-the-a-longman-cultural-edition.pdf
    • http://www.gorillawalker.com/the-global-economy-and-its-economic-systems-upper-level-economics.pdf
    • http://www.gorillawalker.com/directory-of-u-s-labor-organizations-2013-edition.pdf
    • http://www.gorillawalker.com/travels-in-north-america-during-the-years-1834-1835-1836.pdf
    • http://www.gorillawalker.com/the-mormon-cleric-murder.pdf
    • http://www.gorillawalker.com/implementing-iso27001-in-a-windows-environment.pdf
    • http://www.gorillawalker.com/her-perfect-gift-50-loving-states.pdf
    • http://www.gorillawalker.com/the-cold-coasts.pdf
    • http://www.gorillawalker.com/ethnic-crisis-in-sri-lanka-india-s-options.pdf
    • http://www.gorillawalker.com/lighting-redesign-for-existing-buildings.pdf
    • http://www.gorillawalker.com/the-distinctive-character-of-the-free-university-in-amsterdam-1880.pdf
    • http://www.gorillawalker.com/favorite-spanish-folksongs-melody-chords-kindle-edition.pdf
    • http://www.gorillawalker.com/wto-dispute-settlement-one-page-case-summaries-1995-2013.pdf
    • http://www.gorillawalker.com/1999-gmc-chevrolet-c-k-truck-service-manuals-silverado-sierra.pdf
    • http://www.gorillawalker.com/emergency-nursing-principles-practice.pdf
    • http://www.gorillawalker.com/ultrafast-phenomena-v-springer-series-in-chemical-physics.pdf
    • http://www.gorillawalker.com/weight-watchers-quick-cooking-for-busy-people.pdf
    • http://www.gorillawalker.com/canada-and-newfoundland-carpenter-s-world-travels-series.pdf
    • http://www.gorillawalker.com/discourses-and-selected-writings-penguin-classics.pdf
    • http://www.gorillawalker.com/reading-greek-vases.pdf
    • http://www.gorillawalker.com/iso-7589-2002-photography-illuminants-for-sensitometry-specifications-for-daylight.pdf
    • http://www.gorillawalker.com/ukrainian-lonely-planet-phrasebook.pdf
    • http://www.gorillawalker.com/solos-for-the-cello-player-cello-and-piano.pdf
    • http://www.gorillawalker.com/victory-in-tripoli-how-america-s-war-with-the-barbary.pdf
    • http://www.gorillawalker.com/vegetables-recipes-and-techniques-from-the-world-s-premier-culinary.pdf
    • http://www.gorillawalker.com/atlas-of-battle-of-chawinda.pdf
    • http://www.gorillawalker.com/restless-nights-understanding-snoring-and-sleep-apnea.pdf
    • http://www.gorillawalker.com/contributions-of-case-mix-intensity-and-technology-to-hospital-cost.pdf
    • http://www.gorillawalker.com/onyx-lux.pdf
    • http://www.gorillawalker.com/the-trap.pdf
    • http://www.gorillawalker.com/jazz-suite-for-piano-duet.pdf
    • http://www.gorillawalker.com/the-predictors-how-a-band-of-maverick-physicists-used-chaos.pdf
    • http://www.gorillawalker.com/paella.pdf
    • http://www.gorillawalker.com/clifford-va-a-la-escuela-de-perros-spanish-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.