Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bcac6b1a8b0e305…

MALICIOUS

PDF

33.7 KB Created: 2019-09-29 23:46:36 +03:00 Authoring application: - (via Foxit Phantom Printer Version 3.0.3.0804)
MD5: 8e441d3b785c7ad69c4bb8f15f23216e SHA-1: ff84886071924d3b63eb65406b438b3490f7255e SHA-256: 0bcac6b1a8b0e305adc21aa17d5a8e3f9a2ec818890d40ea51f370b5f842abf2
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links, suggesting a link farm. The embedded URLs point to various PDF files on the 'gorillawalker.com' domain. While no scripts were explicitly extracted, the nature of the heuristic and the embedded URLs indicate a potential attempt to manipulate search engine rankings or distribute content via a large number of linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/barbie-thumbelina-barbie-step-into-reading.pdf
    • http://www.gorillawalker.com/pupi-y-el-club-de-los-dinosaurios-pupi-and-the.pdf
    • http://www.gorillawalker.com/language-and-revolution-making-modern-political-identities-the-cummings-center.pdf
    • http://www.gorillawalker.com/thinking-as-sport-and-dance-learn-the-power-of-creative.pdf
    • http://www.gorillawalker.com/don-t-panic-100-poems-to-save-your-life.pdf
    • http://www.gorillawalker.com/dangerous-beauty-life-and-death-in-africa-true-stories-from.pdf
    • http://www.gorillawalker.com/c-w-anderson-s-complete-book-of-horses-and-horsemanship.pdf
    • http://www.gorillawalker.com/the-japanese-effect-in-contemporary-irish-poetry.pdf
    • http://www.gorillawalker.com/dementia-burns-levy.pdf
    • http://www.gorillawalker.com/collected-studies-for-piano-op-100-105-109-schirmer-s.pdf
    • http://www.gorillawalker.com/sea-bed-mechanics-ocean-engineering.pdf
    • http://www.gorillawalker.com/myths-of-the-norsemen-retold-from-the-old-norse-poems.pdf
    • http://www.gorillawalker.com/evening-hymn-sheet-music.pdf
    • http://www.gorillawalker.com/the-city-of-god-xist-classics.pdf
    • http://www.gorillawalker.com/life-on-the-farm-ii-pictures-of-tractors-farm-animals.pdf
    • http://www.gorillawalker.com/agriculture-and-slavery-in-missouri-s-little-dixie.pdf
    • http://www.gorillawalker.com/stand-by-youth-volume-3-v-3.pdf
    • http://www.gorillawalker.com/a-synoptic-key-of-the-materia-medica-volume-2.pdf
    • http://www.gorillawalker.com/an-empire-of-indifference-american-war-and-the-financial-logic.pdf
    • http://www.gorillawalker.com/money-grades-1-2-practice-makes-perfect-teacher-created-materials.pdf
    • http://www.gorillawalker.com/studies-of-laughter-in-interaction.pdf
    • http://www.gorillawalker.com/house-of-ecstasy.pdf
    • http://www.gorillawalker.com/rivethead-tales-from-the-assembly-line-kindle-edition.pdf
    • http://www.gorillawalker.com/michael-s-smith-kitchens-baths.pdf
    • http://www.gorillawalker.com/quit-law-and-code-a-guide-to-transition-from-law.pdf
    • http://www.gorillawalker.com/code-of-federal-regulations-title-7-agriculture-parts-1000-1199.pdf
    • http://www.gorillawalker.com/boy-were-we-wrong-about-the-weather.pdf
    • http://www.gorillawalker.com/investor-state-arbitration.pdf
    • http://www.gorillawalker.com/hired-paths-to-employment-in-the-social-media-era.pdf
    • http://www.gorillawalker.com/taken-the-honeymoon-night.pdf
    • http://www.gorillawalker.com/kant-s-religion-within-the-boundaries-of-mere-reason-a.pdf
    • http://www.gorillawalker.com/new-english-file-advanced-student-s-book.pdf
    • http://www.gorillawalker.com/the-drunken-botanist-the-plants-that-create-the-world-s.pdf
    • http://www.gorillawalker.com/holt-science-technology-teacher-edition-m-forces-motion-and-energy.pdf
    • http://www.gorillawalker.com/the-edge-of-the-shadows-book-3-of-the-edge.pdf
    • http://www.gorillawalker.com/combating-discrimination-persona-dolls-in-action.pdf
    • http://www.gorillawalker.com/armenia-constitution-and-citizenship-laws-handbook-strategic-information-and-basic.pdf
    • http://www.gorillawalker.com/profit-pathology-and-other-indecencies.pdf
    • http://www.gorillawalker.com/tattooing-a-major-route-of-hepatitis-c-infection-an-article.pdf
    • http://www.gorillawalker.com/luther-s-works-volume-51-sermons-i.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.