Malicious PDF — malware analysis report

Static analysis result for SHA-256 1aadd98f28e49e33…

MALICIOUS

PDF

41.2 KB Created: 2019-02-13 19:53:00 +03:00 Authoring application: - (via pdfTeX-1.0b-pdfcrypt)
MD5: 5de83eae0bd7eb82bd7fad8406e05540 SHA-1: 158ecf2c1f5d7bb08503d0b1fdd087024e72b3c4 SHA-256: 1aadd98f28e49e33a26a2dc3683d2973605481985bff1e81e7de89af67d6ad4c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, primarily hosted on 'gorillawalker.com'. This behavior is indicative of a link farm or a redirection scheme designed to drive traffic to numerous other resources. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/propaganda-and-the-american-revolution-1763-1783.pdf
    • http://www.gorillawalker.com/becoming-us-college-love-never-hurt-so-good-london-lovers.pdf
    • http://www.gorillawalker.com/quick-easy-autumn.pdf
    • http://www.gorillawalker.com/biscuits-of-number-theory-dolciani-mathematical-expositions.pdf
    • http://www.gorillawalker.com/young-goodman-brown-tale-blazers.pdf
    • http://www.gorillawalker.com/christianity-and-the-crisis-of-cultures.pdf
    • http://www.gorillawalker.com/the-right-to-development-and-indigenous-peoples-lessons-from-new.pdf
    • http://www.gorillawalker.com/bianca-e-fernando-kalmus-edition-italian-edition.pdf
    • http://www.gorillawalker.com/midnight-shimmer-a-toni-diamond-mystery-toni-diamond-mysteries-volume.pdf
    • http://www.gorillawalker.com/verdi-il-trovatore-an-opera-in-3-acts-kalmus-vocal.pdf
    • http://www.gorillawalker.com/fieldbus-and-networking-in-process-automation.pdf
    • http://www.gorillawalker.com/daisy-s-diary-honeymoon-journey-to-the-far-east.pdf
    • http://www.gorillawalker.com/practical-acupuncture-clinical-handbook.pdf
    • http://www.gorillawalker.com/harlequin-desire-october-2015-box-set-1-of-2-a.pdf
    • http://www.gorillawalker.com/bowel-continence-nursing.pdf
    • http://www.gorillawalker.com/a-tale-of-sleepy-numbers-yamie-chess-math-comics-book.pdf
    • http://www.gorillawalker.com/computed-tomography-principles-design-artifacts-and-recent-advances-second-edition.pdf
    • http://www.gorillawalker.com/look-at-norway.pdf
    • http://www.gorillawalker.com/encyclopedia-animals-entsiklopediya-zhivotnykh.pdf
    • http://www.gorillawalker.com/the-wild-dark-flowers-a-novel-of-rutherford-park.pdf
    • http://www.gorillawalker.com/oh-nuts.pdf
    • http://www.gorillawalker.com/gentleman-s-agreement-1st.pdf
    • http://www.gorillawalker.com/green-pharmacy-the-history-and-evolution-of-western-herbal-medicine.pdf
    • http://www.gorillawalker.com/primary-mistake-how-the-washington-republican-establishment-lost-everythingin-2006.pdf
    • http://www.gorillawalker.com/holt-algebra-1-oklahoma-end-of-instruction-test-prep-and.pdf
    • http://www.gorillawalker.com/modern-arab-american-fiction-a-reader-s-guide-arab-american.pdf
    • http://www.gorillawalker.com/primo-levi-and-humanism-after-auschwitz-posthumanist-reflections-italian-and.pdf
    • http://www.gorillawalker.com/the-girls-of-atomic-city-the-untold-story-of-the.pdf
    • http://www.gorillawalker.com/big-weed-an-entrepreneur-s-high-stakes-adventures-in-the.pdf
    • http://www.gorillawalker.com/pressure-ulcer-treatment-sudoc-he-20-6520-2-15.pdf
    • http://www.gorillawalker.com/agon-ballet-pocket-score-hps-701.pdf
    • http://www.gorillawalker.com/compa-eros-de-oraci-n.pdf
    • http://www.gorillawalker.com/how-to-excel-in-medical-school-2nd-second-edition-bysaks.pdf
    • http://www.gorillawalker.com/between-authority-and-interpretation-on-the-theory-of-law-and.pdf
    • http://www.gorillawalker.com/cucina-fresca.pdf
    • http://www.gorillawalker.com/dark-times.pdf
    • http://www.gorillawalker.com/handbook-of-iron-meteorites-their-history-distribution-composition-and-structure.pdf
    • http://www.gorillawalker.com/day-trip-to-santa-cruz-island-california-scorpion-ranch-east.pdf
    • http://www.gorillawalker.com/sixty-one-sixty-five-company-level-american-civil-war-rules.pdf
    • http://www.gorillawalker.com/1000-airlines-in-color.pdf
    • http://www.gorillawalker.com/verdi-il-tro
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.