Malicious PDF — malware analysis report

Static analysis result for SHA-256 1448f6d51245284b…

MALICIOUS

PDF

44.2 KB Created: 2018-11-30 20:02:40 +03:00 Authoring application: PScript5.dll Version 5.2.2 (via iText 2.1.7 by 1T3XT)
MD5: 4e753982edf63ebf64ed9f6aa3f0ec13 SHA-1: fb70e6c4a2af14584b0f6930e01617a93fdfc136 SHA-256: 1448f6d51245284b3875ae84ae6b55975e5f087b287c2c4297e8c30dc65e548e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files on the domain gorillawalker.com. This behavior is indicative of a link farm or a method to distribute further malicious content. The ML classifier also flagged this PDF as malicious, supporting the suspicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/it-s-the-little-things-the-everyday-interactions-that-get.pdf
    • http://www.gorillawalker.com/how-to-do-verbal-reasoning-a-step-by-step-guide.pdf
    • http://www.gorillawalker.com/understanding-options.pdf
    • http://www.gorillawalker.com/app-savvy-turning-ideas-into-ipad-and-iphone-apps-customers.pdf
    • http://www.gorillawalker.com/natural-products-isolation-methods-in-biotechnology.pdf
    • http://www.gorillawalker.com/progress-in-optics-volume-50.pdf
    • http://www.gorillawalker.com/oberiu-an-anthology-of-russian-absurdism-european-classics.pdf
    • http://www.gorillawalker.com/language-and-the-phenomenological-reductions-of-edmund-husserl-phaenomenologica.pdf
    • http://www.gorillawalker.com/aquatic-entomology-the-fisherman-s-and-ecologist-s-illustrated-guide.pdf
    • http://www.gorillawalker.com/the-temple-of-shamanic-witchcraft-shadows-spirits-and-the-healing.pdf
    • http://www.gorillawalker.com/lonely-planet-santa-fe-taos-lonely-planet.pdf
    • http://www.gorillawalker.com/spectacular-bodies-the-art-and-science-of-the-human-body.pdf
    • http://www.gorillawalker.com/human-and-social-sciences-for-the-new-nation-gr-7.pdf
    • http://www.gorillawalker.com/official-lsat-preptest-58-publisher-law-school-admission-council.pdf
    • http://www.gorillawalker.com/following-the-trend-diversified-managed-futures-trading-wiley-trading-by.pdf
    • http://www.gorillawalker.com/50-winning-duplicate-tips-for-the-improving-tournament-player-master.pdf
    • http://www.gorillawalker.com/asset-protection-strategies-business-practice-library-v-1-2-with.pdf
    • http://www.gorillawalker.com/czarnezki-s-everyday-environmentalism-law-nature-and-individual-behavior-coursebook.pdf
    • http://www.gorillawalker.com/epoxy-resins-curing-agents-compounds-and-modifiers-second-edition-second.pdf
    • http://www.gorillawalker.com/alfabetiskt-register-till-entomologisk-tidskrift-swedish-edition.pdf
    • http://www.gorillawalker.com/impossibility-in-modern-private-law-a-comparative-study-of-german.pdf
    • http://www.gorillawalker.com/q-e-d-beauty-in-mathematical-proof-wooden-books.pdf
    • http://www.gorillawalker.com/community-dances-manual.pdf
    • http://www.gorillawalker.com/look-baby-disney-baby.pdf
    • http://www.gorillawalker.com/the-great-outdoors-scroll-saw-fretwork-patterns-fine-line-design.pdf
    • http://www.gorillawalker.com/the-complete-beginner-s-guide-to-swimming.pdf
    • http://www.gorillawalker.com/caucasian-chalk-circle-the.pdf
    • http://www.gorillawalker.com/pride-of-india.pdf
    • http://www.gorillawalker.com/entertaining-simply.pdf
    • http://www.gorillawalker.com/blood-torn-blackthorn-book-3-kindle-edition.pdf
    • http://www.gorillawalker.com/the-universe-a-voyage-through-space-and-time.pdf
    • http://www.gorillawalker.com/kindermeditation-im-grundschulalter-minimedi-1-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/please-eat-a-mother-s-struggle-to-free-her-teenage.pdf
    • http://www.gorillawalker.com/aprende-ingles-en-siete-dias-spanish-edition.pdf
    • http://www.gorillawalker.com/down-warren-ellis.pdf
    • http://www.gorillawalker.com/the-mountains-of-the-moon.pdf
    • http://www.gorillawalker.com/common-worship-holy-communion-order-one-common-worship-services-and.pdf
    • http://www.gorillawalker.com/5-of-the-best-cheap-and-easy-chicken-recipes-on.pdf
    • http://www.gorillawalker.com/a-hedonist-s-guide-to-rome.pdf
    • http://www.gorillawalker.com/great-doctrines-of-the-bible-volume-3-ecclesiology.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.