Malicious PDF — malware analysis report

Static analysis result for SHA-256 085fb81be522d671…

MALICIOUS

PDF

42.3 KB Created: 2018-11-14 11:21:25 +03:00 Authoring application: FrameMaker 7.2 (via Acrobat Distiller 7.0.5 (Windows))
MD5: c8190c885a31a1879863c3e281d61a05 SHA-1: 058e3c529cb70ce606fa9028fb1580c5d014e8e3 SHA-256: 085fb81be522d6713a8bbe4c6015117e4cd82dc7698f5abbfada8a0eab6abd30
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/mask-and-sword-two-plays-for-the-contemporary-japanese-theater.pdf
    • http://www.gorillawalker.com/une-vraie-famille-roman-fr-hc-french-edition.pdf
    • http://www.gorillawalker.com/burial-and-ancient-society-the-rise-of-the-greek-city.pdf
    • http://www.gorillawalker.com/coding-from-the-operative-report-for-icd-10-cm-and.pdf
    • http://www.gorillawalker.com/earth-wars-the-battle-for-global-resources.pdf
    • http://www.gorillawalker.com/practicing-gnosis-ritual-magic-theurgy-and-liturgy-in-nag-hammadi.pdf
    • http://www.gorillawalker.com/the-9-1-2-secrets-of-a-great-it-organization.pdf
    • http://www.gorillawalker.com/evolution-international-journal-of-organic-evolution-1988-evolution-volume-42.pdf
    • http://www.gorillawalker.com/kaplan-gre-exam-verbal-workbook-text-only-6th-sixth-edition.pdf
    • http://www.gorillawalker.com/the-beatles-day-by-day-the-sixties-as-they-happened.pdf
    • http://www.gorillawalker.com/play-ball-pete-the-cat.pdf
    • http://www.gorillawalker.com/modern-roses-xi-the-world-encyclopedia-of-roses-pt-11.pdf
    • http://www.gorillawalker.com/el-circo-de-la-familia-pilo-eclipse-spanish-edition.pdf
    • http://www.gorillawalker.com/business-mathematics-brief-plus-mymathlab-access-card-package-mystatlab-12th.pdf
    • http://www.gorillawalker.com/essayistik-als-selbsttechnik-wahrheitspraxis-im-zeitalter-der-aufklarung-german-edition.pdf
    • http://www.gorillawalker.com/psychology-bullet-guides.pdf
    • http://www.gorillawalker.com/on-wings-of-song-sheet-music.pdf
    • http://www.gorillawalker.com/pandora-chronicles-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/zoos-a-philosophical-tour.pdf
    • http://www.gorillawalker.com/statistics-for-business-and-economics-ninth-edition.pdf
    • http://www.gorillawalker.com/advances-in-chemical-physics-volume-127.pdf
    • http://www.gorillawalker.com/cool-connections-with-cognitive-behavioural-therapy-encouraging-self-esteem-resilience.pdf
    • http://www.gorillawalker.com/the-flying-carpet-to-baghdad-kindle-edition.pdf
    • http://www.gorillawalker.com/vitamix-guide-the-ultimate-step-by-step-guide-to-using.pdf
    • http://www.gorillawalker.com/from-computing-to-computational-thinking-digital.pdf
    • http://www.gorillawalker.com/viking-town-metropolis-franklin-watts-hardcover.pdf
    • http://www.gorillawalker.com/the-wiley-handbook-on-the-development-of-children-s-memory.pdf
    • http://www.gorillawalker.com/cowboy-desires-the-complete-collection.pdf
    • http://www.gorillawalker.com/basic-data-of-plasma-physics-the-fundamental-data-on-electrical.pdf
    • http://www.gorillawalker.com/the-ex-games-romantic-comedies-mass-market.pdf
    • http://www.gorillawalker.com/code-words-100-of-the-best-code-words-puzzles.pdf
    • http://www.gorillawalker.com/weird-cars-a-compilation-of-77-avant-garde-silly-slow.pdf
    • http://www.gorillawalker.com/le-mie-stelle-poesie-italian-edition.pdf
    • http://www.gorillawalker.com/korean-war-the-perspectives-on-modern-world-history.pdf
    • http://www.gorillawalker.com/the-mississippi-bubble.pdf
    • http://www.gorillawalker.com/spiraled-callahan-mclane-book-3-kindle-edition.pdf
    • http://www.gorillawalker.com/stockholm-sweden-travel-pack-globetrotter-travel-packs.pdf
    • http://www.gorillawalker.com/large-eddy-simulation-in-hydraulics-iahr-monographs.pdf
    • http://www.gorillawalker.com/ptsd-in-pictures-words.pdf
    • http://www.gorillawalker.com/chicago-business-and-industry-from-fur-trade-to-e-commerce.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.