Malicious PDF — malware analysis report

Static analysis result for SHA-256 123eac61099a8648…

MALICIOUS

PDF

45.1 KB Created: 2019-03-17 11:00:51 +03:00 Authoring application: TeXmacs-1.0.7.3 (via GPL Ghostscript 8.70)
MD5: 7afca01659e402375f03a0178aa248f3 SHA-1: e994bb68143c01ed4048bfa85d2a705ffc939f20 SHA-256: 123eac61099a8648a4350f53eec7b91551d6a4a900b010ba47598252ce043c43
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain gorillawalker.com. This pattern is indicative of a link farm, often used for SEO manipulation or to distribute potentially malicious content. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific intent beyond the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8600

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/never-argue-with-a-dead-person-true-and-unbelievable-stories.pdf
    • http://www.gorillawalker.com/scuba-diving-eyewitness-companions.pdf
    • http://www.gorillawalker.com/echo-made-easy-2e.pdf
    • http://www.gorillawalker.com/intermediate-dynamics-for-engineers-complemented-with-simulations-and-animations.pdf
    • http://www.gorillawalker.com/push-open-the-window-contemporary-poetry-from-china.pdf
    • http://www.gorillawalker.com/lippincott-williams-and-wilkins-administrative-medical-assisting.pdf
    • http://www.gorillawalker.com/how-to-write-the-perfect-personal-statement-write-powerful-essays.pdf
    • http://www.gorillawalker.com/julius-caesar-dictator-for-life-turtleback-school-library-binding-edition.pdf
    • http://www.gorillawalker.com/destrabalenguerias-para-trabalengueros-spanish-edition.pdf
    • http://www.gorillawalker.com/gateway-to-arabic-book-1.pdf
    • http://www.gorillawalker.com/the-tiny-hunchbacked-horse.pdf
    • http://www.gorillawalker.com/chibi-vampire-vol-4.pdf
    • http://www.gorillawalker.com/a-turn-to-empire-the-rise-of-imperial-liberalism-in.pdf
    • http://www.gorillawalker.com/the-law-of-equivalents-in-its-relation-to-political-and.pdf
    • http://www.gorillawalker.com/army-of-darkness-adaptation.pdf
    • http://www.gorillawalker.com/power-punching-for-boxing-kickboxing-muay-thai-mma-self-defense.pdf
    • http://www.gorillawalker.com/astrolog-a-una-gu-a-simple-para-el-xito-personal.pdf
    • http://www.gorillawalker.com/eternity-s-wheel-interworld-trilogy-kindle-edition.pdf
    • http://www.gorillawalker.com/the-great-radio-sitcoms.pdf
    • http://www.gorillawalker.com/matematica-vettoriale-matriciale-e-tensoriale-italian-edition.pdf
    • http://www.gorillawalker.com/revitalizing-the-institution-of-marriage-for-the-twenty-first-century.pdf
    • http://www.gorillawalker.com/jewish-vital-records-revision-lists-and-other-holdings-in-the.pdf
    • http://www.gorillawalker.com/the-humanities-higher-education-and-academic-freedom-three-necessary-arguments.pdf
    • http://www.gorillawalker.com/the-night-my-husband-killed-me.pdf
    • http://www.gorillawalker.com/the-solution-is-full-reserve-100-reserve-banking.pdf
    • http://www.gorillawalker.com/life-in-new-amsterdam-picture-the-past.pdf
    • http://www.gorillawalker.com/achados-chistosos-da-psicanalise-na-escrita-de-jose-simao-portuguese.pdf
    • http://www.gorillawalker.com/the-ottoman-touch-traditional-decorative-arts-and-crafts.pdf
    • http://www.gorillawalker.com/patellofemoral-knee-syndrome-a-complete-guide-to-defeat-patellofemoral-knee.pdf
    • http://www.gorillawalker.com/implementing-tqm.pdf
    • http://www.gorillawalker.com/the-art-and-science-of-sails-a-guide-to-modern.pdf
    • http://www.gorillawalker.com/english-today-curso-completo-de-ingles-americano-britanico-spanish-edition.pdf
    • http://www.gorillawalker.com/the-reapers-song-red-river-of-the-north-4.pdf
    • http://www.gorillawalker.com/maggie-falls-off-a-train-a-christian-victorian-mail-order.pdf
    • http://www.gorillawalker.com/802-11-wlans-and-ip-networking-security-qos-and-mobility.pdf
    • http://www.gorillawalker.com/coping-with-kidney-disease-a-12-step-treatment-program-to.pdf
    • http://www.gorillawalker.com/mitos-y-leyendas-cubanas-spanish-edition.pdf
    • http://www.gorillawalker.com/intermediate-algebra-an-applied-approach.pdf
    • http://www.gorillawalker.com/foster-families-my-family.pdf
    • http://www.gorillawalker.com/routledge-handbook-of-the-sociology-of-sport-routledge-international-handbooks.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.