Malicious PDF — malware analysis report

Static analysis result for SHA-256 0904694632d6aaf4…

MALICIOUS

PDF

45.3 KB Created: 2018-11-23 08:05:57 +03:00 Authoring application: TeX (via dvipdfmx)
MD5: 12a696cf3dbbee83662399c7df900234 SHA-1: ca92a15e459be55fbf51fe18f894258dea81d4df SHA-256: 0904694632d6aaf481f088ac58dda4aab52e9121cbcb54dcdbeacbc61ba6f3c9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This pattern is indicative of a link farm, often used for SEO manipulation or to distribute malicious content disguised as legitimate documents. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8812

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/mother-opossum-and-her-babies.pdf
    • http://www.gorillawalker.com/rainbow-foot-reflexology-acupressure-massage-chart.pdf
    • http://www.gorillawalker.com/citrus-vol-3.pdf
    • http://www.gorillawalker.com/latter-day-saints-and-the-sabbath.pdf
    • http://www.gorillawalker.com/an-arctic-voyage-to-baffin-s-bay-and-lancaster-sound.pdf
    • http://www.gorillawalker.com/they-called-me-high-yellow-nigger-kindle-edition.pdf
    • http://www.gorillawalker.com/annual-franchise-and-distribution-law-developments-2013.pdf
    • http://www.gorillawalker.com/fortran-programs-for-aerodynamic-analyses-on-the-microvax-2000-cad.pdf
    • http://www.gorillawalker.com/sacred-song-of-the-hermit-thrush-a-native-american-legend.pdf
    • http://www.gorillawalker.com/partners-in-praise-hymns-gospel-songs-and-seasonal-selections-lillenas.pdf
    • http://www.gorillawalker.com/a-students-guide-to-estates-in-land-and-future-interests.pdf
    • http://www.gorillawalker.com/somewhere-from-west-side-story.pdf
    • http://www.gorillawalker.com/butterworths-intellectual-property-law-handbook.pdf
    • http://www.gorillawalker.com/hannah-collins-the-fragile-feast-routes-to-ferran-adri.pdf
    • http://www.gorillawalker.com/adhd-involves-neurobiology-and-personality-an-article-from-family-practice.pdf
    • http://www.gorillawalker.com/hay-alguien-ahi-biblioteca-gaarder-las-tres-edades-the-three.pdf
    • http://www.gorillawalker.com/der-morgen-an-dem-ich-die-milch-holte-eine-jugend.pdf
    • http://www.gorillawalker.com/decorated-earthenware-the-complete-potter.pdf
    • http://www.gorillawalker.com/survival-preparedness-a-beginners-guide-to-survival-prepping.pdf
    • http://www.gorillawalker.com/the-hidden-himalayas.pdf
    • http://www.gorillawalker.com/blue-girl.pdf
    • http://www.gorillawalker.com/qualitative-methods-in-military-studies-research-experiences-and-challenges-cass.pdf
    • http://www.gorillawalker.com/the-sun-pull-ahead-books.pdf
    • http://www.gorillawalker.com/technical-writing-dantes-dsst-test-study-guide-pass-your-class.pdf
    • http://www.gorillawalker.com/rabbits-keeping-and-caring-for-your-pet.pdf
    • http://www.gorillawalker.com/fundamental-concepts-and-skills-for-nursing-and-virtual-clinical-excursions.pdf
    • http://www.gorillawalker.com/the-yeast-connection-handbook-kindle-edition.pdf
    • http://www.gorillawalker.com/the-real-mother-goose-a-steamy-bdsm-fairy-tale-romance.pdf
    • http://www.gorillawalker.com/38-000-for-a-friendly-face.pdf
    • http://www.gorillawalker.com/3-quartets-for-two-violins-viola-and-cello-with-bass.pdf
    • http://www.gorillawalker.com/men-s-travel-in-your-pocket-tours-accommodations-nightlife-for.pdf
    • http://www.gorillawalker.com/java-the-complete-reference.pdf
    • http://www.gorillawalker.com/population-and-development-programme-of-action-adopted-at-the-international.pdf
    • http://www.gorillawalker.com/the-wisdom-of-ben-sira-studies-on-tradition-redaction-and.pdf
    • http://www.gorillawalker.com/ricoh-s-sustainability-optimisation-programme-kindle-edition.pdf
    • http://www.gorillawalker.com/suzuki-vs1400-intruder-1987-2003-clymer-motorcycle-repair.pdf
    • http://www.gorillawalker.com/cooking-for-candida-recipes-and-diet-plans-with-vegetarian-options.pdf
    • http://www.gorillawalker.com/cocinando-con-judith-cooking-with-judith-spanish-edition.pdf
    • http://www.gorillawalker.com/antituberculosis-drugs-handbook-of-experimental-pharmacology.pdf
    • http://www.gorillawalker.com/monongahela-river-navigation-charts-pittsburgh-pennsylvania-to-fairmont-west-virginia.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.