Malicious PDF — malware analysis report

Static analysis result for SHA-256 175e0d562d374d55…

MALICIOUS

PDF

45.5 KB Created: 2019-03-18 06:17:36 +03:00 Authoring application: Writer (via OpenOffice.org 2.0)
MD5: 8873f38d6e4a0e120e7cf20c5580c7f5 SHA-1: 43621bd615ae618fdc06c117bee37538a870043f SHA-256: 175e0d562d374d556aa815815d0b260edbcb94f9cc603890e92f9da76290d5b6
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing for a large number of external links, all pointing to PDFs hosted on 'gorillawalker.com'. This suggests a link farm or SEO manipulation tactic. While no scripts were explicitly extracted, the PDF structure and the sheer volume of embedded URLs indicate a malicious intent to redirect users. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8173

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/caring-for-a-loved-one-with-cancer.pdf
    • http://www.gorillawalker.com/rewarding-provider-performance-aligning-incentives-in-medicare-pathways-to-quality.pdf
    • http://www.gorillawalker.com/market-risk-analysis-practical-financial-econometrics-volume-ii.pdf
    • http://www.gorillawalker.com/basic-clinical-endocrinology.pdf
    • http://www.gorillawalker.com/dr-mcnaughty-3-doctor-s-orders-fertile-bareback-doctor-exam.pdf
    • http://www.gorillawalker.com/gef.pdf
    • http://www.gorillawalker.com/but-my-soul-is-black.pdf
    • http://www.gorillawalker.com/fodor-s-bahamas-plus-turks-caicos-full-color-travel-guide.pdf
    • http://www.gorillawalker.com/equi-stretch-seated-workout-dvd-equi-stretch-home-workout-dvds.pdf
    • http://www.gorillawalker.com/copy-editors-handbook-for-newspapers.pdf
    • http://www.gorillawalker.com/willing-victim.pdf
    • http://www.gorillawalker.com/taste-wine-like-a-pro-think-like-a-genius-wine.pdf
    • http://www.gorillawalker.com/photography-lighting-and-composition-by-bruno-of-hollywood.pdf
    • http://www.gorillawalker.com/records-of-the-u-s-department-of-state-relating-to.pdf
    • http://www.gorillawalker.com/killer-athletes-america-s-elite-special-operations-warriors-share-lessons.pdf
    • http://www.gorillawalker.com/watercolour-skills-workbook.pdf
    • http://www.gorillawalker.com/creating-high-performance-teams-applied-strategies-and-tools-for-managers.pdf
    • http://www.gorillawalker.com/within-these-woods-a-collection-of-northwoods-nature-essays-with.pdf
    • http://www.gorillawalker.com/mysteries-of-templar-treasure-the-holy-grail-the-secrets-of.pdf
    • http://www.gorillawalker.com/chad-labor-laws-and-regulations-handbook-strategic-information-and-basic.pdf
    • http://www.gorillawalker.com/lock-on-no-5-general-dynamics-f-111-e-f.pdf
    • http://www.gorillawalker.com/getting-funded-a-complete-guide-to-proposal-writing.pdf
    • http://www.gorillawalker.com/a-time-of-change-trading-post.pdf
    • http://www.gorillawalker.com/velvet-underground-s-the-velvet-underground-and-nico-thirty-three.pdf
    • http://www.gorillawalker.com/dangerous-dates.pdf
    • http://www.gorillawalker.com/springboks-and-the-holy-grail-behind-the-scenes-at-the.pdf
    • http://www.gorillawalker.com/official-isc-2-guide-to-the-cap-cbk-second-edition.pdf
    • http://www.gorillawalker.com/mark-wallinger-credo.pdf
    • http://www.gorillawalker.com/operational-logistics-the-art-and-science-of-sustaining-military-operations.pdf
    • http://www.gorillawalker.com/blindfold-fantasy-a-novel-menage-kindle-edition.pdf
    • http://www.gorillawalker.com/the-nature-of-mind.pdf
    • http://www.gorillawalker.com/pictures-of-grace-mediations-on-god-s-grace.pdf
    • http://www.gorillawalker.com/happy-accidents-serendipity-in-major-medical-breakthroughs-in-the-twentieth.pdf
    • http://www.gorillawalker.com/amboseli-map-the-national-park-and-dispersal-area.pdf
    • http://www.gorillawalker.com/provence-food-wine-culture-and-landscape.pdf
    • http://www.gorillawalker.com/based-on-industry-cluster-in-liaoning-automotive-industry-development.pdf
    • http://www.gorillawalker.com/jackson-s-mixed-martial-arts-the-ground-game-by-jackson.pdf
    • http://www.gorillawalker.com/the-world-today-current-problems-and-their-origins.pdf
    • http://www.gorillawalker.com/three-little-pigs.pdf
    • http://www.gorillawalker.com/colin-oates-judo-getting-started.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.