Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d9f098cc2e57208…

MALICIOUS

PDF

45.2 KB Created: 2018-12-14 10:23:46 +03:00 Authoring application: XEP 4.4 build 20050610
MD5: 91c5bd504e75dd178146372d44ac88fe SHA-1: 71af989a8ccd9e57859fcd3831e62ffb9dbe39e1 SHA-256: 0d9f098cc2e572085ee889ab875656a2c16784bcd6ea664f0f51e7d6e7e2d3c9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary purpose appears to be directing users to a large collection of documents hosted on www.gorillawalker.com, likely for SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8812

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/dredging-94-proceedings-of-the-second-international-conference-on-dredging.pdf
    • http://www.gorillawalker.com/critical-path-analysis-and-other-project-network-techniques-solutions-manual.pdf
    • http://www.gorillawalker.com/dk-biography-martin-luther-king-jr.pdf
    • http://www.gorillawalker.com/las-8-piezas-del-rompecabezas-material-de-estudios-para-grupos.pdf
    • http://www.gorillawalker.com/designing-disney-s-theme-parks-the-architecture-of-reassurance.pdf
    • http://www.gorillawalker.com/an-introduction-to-violent-us-gangs-understanding-violent-gangs-in.pdf
    • http://www.gorillawalker.com/maintenance-carpenter-passbooks-career-exam-ser-c-1349.pdf
    • http://www.gorillawalker.com/by-editors-of-race-point-publishing-fanciful-fairy-gardens-2015.pdf
    • http://www.gorillawalker.com/party-autonomy-in-contractual-and-non-contractual-obligations-a-european.pdf
    • http://www.gorillawalker.com/fundamentals-of-structural-integrity-damage-tolerant-design-and-nondestructive-evaluation.pdf
    • http://www.gorillawalker.com/cranes-mighty-machines-qeb.pdf
    • http://www.gorillawalker.com/kalila-wa-dimna-fables-from-a-fourteenth-century-arabic-manuscript.pdf
    • http://www.gorillawalker.com/the-united-states-pony-clubs-manual-of-horsemanship-book-3.pdf
    • http://www.gorillawalker.com/intuitive-composition-a-right-brain-approach-to-achieving-simplicity-harmony.pdf
    • http://www.gorillawalker.com/blade-design-and-analysis-for-steam-turbines.pdf
    • http://www.gorillawalker.com/fantasy-pieces-for-piano-and-clarinet-op-73-softcover-version.pdf
    • http://www.gorillawalker.com/a-war-of-witches-a-journey-into-the-underworld-of.pdf
    • http://www.gorillawalker.com/storm-over-chile-the-junta-under-siege.pdf
    • http://www.gorillawalker.com/hospital-mergers-why-they-work-why-they-don-t.pdf
    • http://www.gorillawalker.com/alice-mumford.pdf
    • http://www.gorillawalker.com/macromolecular-chemistry-2.pdf
    • http://www.gorillawalker.com/bailey-boat-cat-adventures-of-a-feline-afloat.pdf
    • http://www.gorillawalker.com/the-third-revolution-popular-movements-in-the-revolutionary-era-global.pdf
    • http://www.gorillawalker.com/death-comes-to-the-ballets-russes-lord-francis-powerscourt.pdf
    • http://www.gorillawalker.com/the-gates-of-repentance.pdf
    • http://www.gorillawalker.com/crime-justice-and-society-an-introduction-to-criminology.pdf
    • http://www.gorillawalker.com/optically-stimulated-luminescence-dosimetry.pdf
    • http://www.gorillawalker.com/the-total-library-non-fiction-1922-1986-penguin-modern-classics.pdf
    • http://www.gorillawalker.com/an-actor-s-craft-the-art-and-technique-of-acting.pdf
    • http://www.gorillawalker.com/quickbooks-for-your-law-practice.pdf
    • http://www.gorillawalker.com/business-communication-today-student-value-edition-plus-mybcommlab-with-pearson.pdf
    • http://www.gorillawalker.com/cassbella.pdf
    • http://www.gorillawalker.com/muslim-prayer-and-worship.pdf
    • http://www.gorillawalker.com/reboot-rejoice-how-i-healed-from-parkinson-s-disease-using.pdf
    • http://www.gorillawalker.com/outside-a-post-apocalyptic-novel-outside-series-book-1-kindle.pdf
    • http://www.gorillawalker.com/looking-for-the-light-the-hidden-life-and-art-of.pdf
    • http://www.gorillawalker.com/a-different-outlook-on-bipolar-disorder-ups-and-downs-to.pdf
    • http://www.gorillawalker.com/creating-dslr-video-from-snapshots-to-great-shots-by-harrington.pdf
    • http://www.gorillawalker.com/the-prose-or-younger-edda-commonly-ascribed-to-snorri-sturluson.pdf
    • http://www.gorillawalker.com/2-100-victorian-monograms-lettering-calligraphy-typography.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.