Malicious PDF — malware analysis report

Static analysis result for SHA-256 10853ff474904255…

MALICIOUS

PDF

42.4 KB Created: 2018-11-23 08:06:09 +03:00 Authoring application: Microsoft® Office Word 2007
MD5: 7a84a66a53cfcfb3450778c8e0d0b580 SHA-1: e500c562a68814df9eadf2427ce841bdd76749bb SHA-256: 10853ff474904255d0b29f997d1ba9837fced1683aa05a5747fa6d75ce776205
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute a large volume of content, potentially malicious. No scripts were extracted, and the document body was unreadable, limiting further analysis of intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8698

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/how-to-power-tune-minis-on-a-small-budget-speedpro.pdf
    • http://www.gorillawalker.com/why-projects-fail-in-the-public-sector.pdf
    • http://www.gorillawalker.com/daring-rescue-at-sonora-pass-adventures-on-the-american-frontier.pdf
    • http://www.gorillawalker.com/the-ida-pro-book-the-unofficial-guide-to-the-world.pdf
    • http://www.gorillawalker.com/bartlett-s-familiar-quotations-a-collection-of-passages-phrases-and.pdf
    • http://www.gorillawalker.com/the-parrot-who-owns-me-the-story-of-a-relationship.pdf
    • http://www.gorillawalker.com/adventure-week-travel-essays-by-students-from-the-american-international.pdf
    • http://www.gorillawalker.com/discourse-and-the-non-native-english-speaker.pdf
    • http://www.gorillawalker.com/how-to-sell-your-house-without-a-real-estate-agent.pdf
    • http://www.gorillawalker.com/der-mythos-bei-markus-beihefte-zur-zeitschrift-fur-die-neutestamentliche.pdf
    • http://www.gorillawalker.com/aircraft-engines-classic-reprint.pdf
    • http://www.gorillawalker.com/multi-phase-flow-in-oil-and-gas-well-drilling.pdf
    • http://www.gorillawalker.com/the-proud-tree.pdf
    • http://www.gorillawalker.com/reborn-the-cartographer-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/ibrahim-khan-and-the-mystery-of-the-haunted-lake-ibrahim.pdf
    • http://www.gorillawalker.com/israeli-security-warrior-training.pdf
    • http://www.gorillawalker.com/el-artista-que-pint-un-caballo-azul-spanish-edition.pdf
    • http://www.gorillawalker.com/deitore-for-10-tuba-steadily-progress-2010-isbn-4872252101-japanese.pdf
    • http://www.gorillawalker.com/get-anyone-to-do-anything-kindle-edition.pdf
    • http://www.gorillawalker.com/financial-math-reproducible-book-1.pdf
    • http://www.gorillawalker.com/costimulation-immunotherapy-for-autoimmunity-transplantation-and-lymphomas-allergies-and-infectious.pdf
    • http://www.gorillawalker.com/april-showers-children-s-chapter-book-with-illustrated-24-pictures.pdf
    • http://www.gorillawalker.com/winter-s-tale-hidden-series.pdf
    • http://www.gorillawalker.com/liver-cleansing-handbook-natural-health-guide.pdf
    • http://www.gorillawalker.com/unwed-a-suspenseful-historical-romance-southern-secrets-switched-series-volume.pdf
    • http://www.gorillawalker.com/honorary-white.pdf
    • http://www.gorillawalker.com/faro-algarve-portugal-travel-guide-sightseeing-hotel-restaurant-shopping-highlights.pdf
    • http://www.gorillawalker.com/the-elves-first-christmas.pdf
    • http://www.gorillawalker.com/ten-mile-morning-my-journey-through-anorexia-nervosa.pdf
    • http://www.gorillawalker.com/tequila-mockingbird-cocktails-with-a-literary-twist-by-tim-federle.pdf
    • http://www.gorillawalker.com/slaying-the-badger-greg-lemond-bernard-hinault-and-the-greatest.pdf
    • http://www.gorillawalker.com/know-your-dals-pulses.pdf
    • http://www.gorillawalker.com/wavelet-image-and-video-compression-the-springer-international-series-in.pdf
    • http://www.gorillawalker.com/saint-a-novel.pdf
    • http://www.gorillawalker.com/badminton-5th-edition.pdf
    • http://www.gorillawalker.com/theatre-profiles-12-the-illustrated-guide-to-america-s-nonprofit.pdf
    • http://www.gorillawalker.com/joy-of-signing-puzzle-book-1.pdf
    • http://www.gorillawalker.com/chromatographic-methods.pdf
    • http://www.gorillawalker.com/southwest-comfort-food-slow-and-savory.pdf
    • http://www.gorillawalker.com/yuba-river-poems-prose-kindle-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.