Malicious PDF — malware analysis report

Static analysis result for SHA-256 184007135fef3bb7…

MALICIOUS

PDF

35.6 KB Created: 2019-12-29 00:47:00 +03:00 Authoring application: Adobe InDesign CS (3.0.1) (via Adobe PDF Library 6.0)
MD5: 3036ecd966cae3a41d3f060331c4ceb2 SHA-1: dc278e25b894521bf17ab0e82cb046db90b054d2 SHA-256: 184007135fef3bb7b7dbcc2cc2f9a2fee965da33f720c2a5e13ed7bf3d38119a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute a payload. While no scripts were explicitly extracted, the PDF structure and the heuristic 'PDF_SEO_LINK_FARM' strongly suggest malicious intent. The ML classifier also flagged the document as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8255

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/focus-on-pulmonary-pharmacology-and-toxicologyvolume-iii-discontinued-focus-on.pdf
    • http://www.gorillawalker.com/the-dog-named-elvis-caper.pdf
    • http://www.gorillawalker.com/before-you-begin-a-weight-loss-program-again-the-prediet.pdf
    • http://www.gorillawalker.com/reinventing-project-management-the-diamond-approach-to-successful-growth-innovation.pdf
    • http://www.gorillawalker.com/oregon-on-my-mind-america-on-my-mind.pdf
    • http://www.gorillawalker.com/anabolic-steroid-abuse.pdf
    • http://www.gorillawalker.com/caught-in-the-act-newlyweds-are-trained-by-older-swingers.pdf
    • http://www.gorillawalker.com/the-best-american-sports-writing-1991.pdf
    • http://www.gorillawalker.com/man-an-organic-community-v-1-being-an-exposition-of.pdf
    • http://www.gorillawalker.com/ultimate-unofficial-guide-to-the-mysteries-of-harry-potter-analysis.pdf
    • http://www.gorillawalker.com/information-routing-correspondence-finding-and-object-recognition-in-the-brain.pdf
    • http://www.gorillawalker.com/body-art-issue-no-16.pdf
    • http://www.gorillawalker.com/accordion-sheet-music-aragonaise-arranged-by-charles-magnante.pdf
    • http://www.gorillawalker.com/geometrical-and-physical-optics-a-longman-text.pdf
    • http://www.gorillawalker.com/popular-songs-for-easy-classical-guitar.pdf
    • http://www.gorillawalker.com/krav-maga-real-world-solutions-to-real-world-violence.pdf
    • http://www.gorillawalker.com/lunch-at-the-zoo-what-zoo-animals-eat-and-why.pdf
    • http://www.gorillawalker.com/hard-core-power-pleasure-and-the-frenzy-of-the-visible.pdf
    • http://www.gorillawalker.com/tricked-by-the-futa-the-cheerleader-s-trap-kindle-edition.pdf
    • http://www.gorillawalker.com/food-processor-cookery-the-a-b-c-of-spice-cookery.pdf
    • http://www.gorillawalker.com/erotic-tales-of-old-russia.pdf
    • http://www.gorillawalker.com/developing-performance-based-assessments-grades-6-12.pdf
    • http://www.gorillawalker.com/early-ontario-settlers-a-source-book.pdf
    • http://www.gorillawalker.com/pdr-immunization-clinical-reference-pdr-clinical-handbooks.pdf
    • http://www.gorillawalker.com/demonology-by-king-james-i-forgotten-books.pdf
    • http://www.gorillawalker.com/wildlife-preservation-trust-special-scientific-report-no-3-conservation-biology.pdf
    • http://www.gorillawalker.com/braintrust-what-neuroscience-tells-us-about-morality.pdf
    • http://www.gorillawalker.com/joan-crawford-the-essential-biography.pdf
    • http://www.gorillawalker.com/promoting-the-health-of-adolescents-new-directions-for-the-twenty.pdf
    • http://www.gorillawalker.com/delicious-sloppy-alone-according-to-scientific-experiments-the-amazing-phenomenon.pdf
    • http://www.gorillawalker.com/healing-psoriasis-with-mediterranean-cooking-kindle-edition.pdf
    • http://www.gorillawalker.com/how-to-work-the-competition-into-the-ground.pdf
    • http://www.gorillawalker.com/rise-and-be-seated-the-ups-and-downs-of-jewish.pdf
    • http://www.gorillawalker.com/an-investment-primer-for-new-investors-a-step-by-step.pdf
    • http://www.gorillawalker.com/your-first-move-chess-for-beginners.pdf
    • http://www.gorillawalker.com/chicomoztoc-a-search-for-the-aztec-treasure-and-the-truth.pdf
    • http://www.gorillawalker.com/upper-and-lower-respiratory-disease-lung-biology-in-health-and.pdf
    • http://www.gorillawalker.com/cada-d-a-con-napole-n-hill-spanish-edition.pdf
    • http://www.gorillawalker.com/japanese-fashions.pdf
    • http://www.gorillawalker.com/2014-world-chamber-of-commerce-directory.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.