Malicious PDF — malware analysis report

Static analysis result for SHA-256 1263e9d24d1ba944…

MALICIOUS

PDF

45.1 KB Created: 2019-02-13 02:16:58 +03:00 Authoring application: - (via Acrobat Web Capture 8.0)
MD5: 107982030776730574ab547826d96c57 SHA-1: f37cd4032ab59a5eb852f7048055637044178a8a SHA-256: 1263e9d24d1ba9442863691ac691d502f62f89bbd6a7d5b8c02f0777f5ff9651
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute potentially malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8822

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/infants-toddlers-and-caregivers-a-curriculum-of-respectful-responsive-care.pdf
    • http://www.gorillawalker.com/driving-on-the-edge-the-art-and-science-of-race.pdf
    • http://www.gorillawalker.com/theophrastean-studies-on-natural-science-physics-and-metaphysics-ethics-religion.pdf
    • http://www.gorillawalker.com/rainy-day-fun-cards-fun-card-decks.pdf
    • http://www.gorillawalker.com/girls-know-best-advice-for-girls-from-girls-on-just.pdf
    • http://www.gorillawalker.com/the-new-zealand-bed-and-breakfast-book-homes-farms-guest.pdf
    • http://www.gorillawalker.com/the-decorations-medals-ribbons-badges-and-insignia-of-the-united.pdf
    • http://www.gorillawalker.com/the-days-of-his-presence-experiencing-the-fullness-of-christ.pdf
    • http://www.gorillawalker.com/linguistics-a-complete-introduction-ty-complete-courses.pdf
    • http://www.gorillawalker.com/sowing-with-confidence.pdf
    • http://www.gorillawalker.com/jumpstarters-for-abbreviations-grades-4-8.pdf
    • http://www.gorillawalker.com/my-trip-with-the-tsar-a-novel.pdf
    • http://www.gorillawalker.com/women-in-mexico-a-past-unveiled-llilas-translations-from-latin.pdf
    • http://www.gorillawalker.com/legacy-of-discord-voices-of-the-vietnam-era.pdf
    • http://www.gorillawalker.com/assessment-of-young-children-with-special-needs-a-context-based.pdf
    • http://www.gorillawalker.com/quantum-theory-of-many-body-systems-techniques-and-applications-graduate.pdf
    • http://www.gorillawalker.com/coaching-websites-that-convert-build-a-client-attracting-website-avoid.pdf
    • http://www.gorillawalker.com/physical-properties-of-iii-v-semiconductor-compounds.pdf
    • http://www.gorillawalker.com/cyberbullying-introducing-issues-with-opposing-viewpoints.pdf
    • http://www.gorillawalker.com/the-sixteenth-century-reformation-access-to-history.pdf
    • http://www.gorillawalker.com/contemporary-mathematics-for-business-and-consumers.pdf
    • http://www.gorillawalker.com/robert-e-lee-vol-1.pdf
    • http://www.gorillawalker.com/oil-creative-techniques.pdf
    • http://www.gorillawalker.com/trauma-cranico-e-terapia-occupazionale-guida-all-autonomia-nella-vita.pdf
    • http://www.gorillawalker.com/the-ultimate-burns-supper-book-a-practical-but-irreverant-guide.pdf
    • http://www.gorillawalker.com/violin-solos-on-balkan-folk-songs-and-dances.pdf
    • http://www.gorillawalker.com/sports-illustrated-greatest-pictures-memorable-images-from-sports-history.pdf
    • http://www.gorillawalker.com/modern-persian-reader.pdf
    • http://www.gorillawalker.com/moon-spotlight-salt-lake-city-park-city.pdf
    • http://www.gorillawalker.com/the-cultural-politics-of-jazz-collectives-this-is-our-music.pdf
    • http://www.gorillawalker.com/terrorizing-women-feminicide-in-the-americas.pdf
    • http://www.gorillawalker.com/easter-island-ile-de-paques-isla-de-pascua.pdf
    • http://www.gorillawalker.com/great-women-of-the-suffrage-movement-we-the-people-industrial.pdf
    • http://www.gorillawalker.com/kawasaki-kz500-550-zx550-79-85.pdf
    • http://www.gorillawalker.com/oldman-s-guide-to-outsmarting-wine-108-ingenious-shortcuts-to.pdf
    • http://www.gorillawalker.com/david-worshiped-a-living-god.pdf
    • http://www.gorillawalker.com/the-mount-st-helens-volcano-take-ten-books.pdf
    • http://www.gorillawalker.com/an-introduction-to-contemporary-metaethics.pdf
    • http://www.gorillawalker.com/gousha-city-map-tucson.pdf
    • http://www.gorillawalker.com/by-denise-f-polit-nursing-research-generating-and-assessing-evidence.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.