Malicious PDF — malware analysis report

Static analysis result for SHA-256 138c33002e66f353…

MALICIOUS

PDF

40.5 KB Created: 2018-12-28 08:08:59 +03:00 Authoring application: AH Formatter V5.3 MR1 for Windows (via Acrobat Distiller 8.1.0 (Windows))
MD5: 31e1ec45e7b35c96ad9c04b304fb82be SHA-1: 28da46cc53f903eadc6b7b51c6a22c8d26fd20cf SHA-256: 138c33002e66f353c909ce04a4aff1a5c1ac2ea8a681bc59fbf289ca20d0cc25
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute a variety of content, potentially including malicious payloads. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7974

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/light-and-shade-sketches-from-an-uncommon-life.pdf
    • http://www.gorillawalker.com/be-safe.pdf
    • http://www.gorillawalker.com/manon-lescaut-oxford-world-s-classics.pdf
    • http://www.gorillawalker.com/life-among-the-lutherans-text-only-by-g-keillor.pdf
    • http://www.gorillawalker.com/6-gotta-win-roulette-systems-kindle-edition.pdf
    • http://www.gorillawalker.com/the-word-game-power-workout.pdf
    • http://www.gorillawalker.com/unbillable-hours-a-true-story.pdf
    • http://www.gorillawalker.com/popular-culture-political-economy-and-the-death-of-feminism-why.pdf
    • http://www.gorillawalker.com/her-prince-charming-an-inspirational-romance.pdf
    • http://www.gorillawalker.com/jesus-our-guide-book-4-faith-and-life-catechisms.pdf
    • http://www.gorillawalker.com/houseboat-on-the-nile.pdf
    • http://www.gorillawalker.com/alan-rogers-central-europe-and-croatia-2005-quality-camping-and.pdf
    • http://www.gorillawalker.com/they-called-me-red.pdf
    • http://www.gorillawalker.com/stay-the-distance-kindle-edition.pdf
    • http://www.gorillawalker.com/the-hitchhiker-part-1-on-the-run.pdf
    • http://www.gorillawalker.com/patriotic-instrumental-solos-level-2-3-trombone.pdf
    • http://www.gorillawalker.com/rio-de-janeiro-footprint-pocket-guides.pdf
    • http://www.gorillawalker.com/the-secrets-of-sissification-a-gender-bender-compilation.pdf
    • http://www.gorillawalker.com/bridge-burner-hyperion-the-bridge-burner-trilogy-volume-1.pdf
    • http://www.gorillawalker.com/chinese-for-children-phonetics-w-cd-english-and-chinese-edition.pdf
    • http://www.gorillawalker.com/sea-creatures-it-s-fun-to-draw-library-binding.pdf
    • http://www.gorillawalker.com/snarleyyow-or-the-dog-fiend-classics-of-naval-fiction.pdf
    • http://www.gorillawalker.com/celebrating-chinese-new-year-an-activity-book.pdf
    • http://www.gorillawalker.com/murders-unsolved-vol-2-more-cases-that-have-baffled-the.pdf
    • http://www.gorillawalker.com/insiders-guide-to-myrtle-beach-and-the-grand-strand-9th.pdf
    • http://www.gorillawalker.com/geistliches-lied-sacred-song-op-30-vocal-score-oxford-choral.pdf
    • http://www.gorillawalker.com/pacific-crest-trail-pocket-maps-northern-california.pdf
    • http://www.gorillawalker.com/writing-strategies-book-1-intermediate.pdf
    • http://www.gorillawalker.com/audio-culture-readings-in-modern-music.pdf
    • http://www.gorillawalker.com/production-safety-for-film-television-and-video.pdf
    • http://www.gorillawalker.com/emotional-value-creating-strong-bonds-with-your-customers.pdf
    • http://www.gorillawalker.com/aftermath-the-remnants-of-war-from-landmines-to-chemical-warfare.pdf
    • http://www.gorillawalker.com/fiji-webster-s-timeline-history-1997-2007.pdf
    • http://www.gorillawalker.com/george-clinton-the-cosmic-odyssey-of-dr-funkenstein.pdf
    • http://www.gorillawalker.com/in-korea-with-marquis-ito.pdf
    • http://www.gorillawalker.com/2009-ieee-radar-conference.pdf
    • http://www.gorillawalker.com/edge-of-destruction-hardy-boys-casefiles-case-5.pdf
    • http://www.gorillawalker.com/what-men-need-to-know-about-women.pdf
    • http://www.gorillawalker.com/criminal-abortion-its-nature-its-evidence-and-its-law.pdf
    • http://www.gorillawalker.com/night-trip-kindle-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.