Malicious PDF — malware analysis report

Static analysis result for SHA-256 20e9d0228f821d71…

MALICIOUS

PDF

45.3 KB Created: 2019-03-17 04:40:47 +03:00 Authoring application: Adobe InDesign CC 2017 (Windows) (via Adobe PDF Library 15.0)
MD5: e92252ea8e78a17eb2e3012278dacdad SHA-1: eb6951046ffd5f594fffd754cb07659cbce126b2 SHA-256: 20e9d0228f821d716cec7a7bd58701104fe350fe8863aaa65ccabc403aa6de3b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. It contains a large number of embedded links to external PDF files hosted on 'gorillawalker.com', indicating a potential link farm or distribution mechanism. The primary attack pattern appears to be the use of a large number of external links within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-british-empire-a-very-short-introduction-very-short-introductions.pdf
    • http://www.gorillawalker.com/getting-in-the-game.pdf
    • http://www.gorillawalker.com/criminal-records-teaching-tv-crime-series.pdf
    • http://www.gorillawalker.com/civil-war-kids-150-fifty-fun-things-to-do-see.pdf
    • http://www.gorillawalker.com/paradise-leaving-paradise-return-to-paradise-paperback.pdf
    • http://www.gorillawalker.com/european-pharmacopoeia-4th-ed-supplement-4-5.pdf
    • http://www.gorillawalker.com/law-and-public-choice-a-critical-introduction-by-farber-1991.pdf
    • http://www.gorillawalker.com/astrofit-the-astronaut-program-for-anti-aging.pdf
    • http://www.gorillawalker.com/how-to-f-ck-a-woman.pdf
    • http://www.gorillawalker.com/the-handbook-for-no-load-investors.pdf
    • http://www.gorillawalker.com/a-chosen-faith-an-introduction-to-unitarian-universalism.pdf
    • http://www.gorillawalker.com/tusculan-disputations-on-the-nature-of-the-gods-and-on.pdf
    • http://www.gorillawalker.com/first-children-s-bible.pdf
    • http://www.gorillawalker.com/the-touch-of-god.pdf
    • http://www.gorillawalker.com/the-shoulder-2-volume-set.pdf
    • http://www.gorillawalker.com/corporate-governance-in-the-european-insurance-industry-roma-tre-business.pdf
    • http://www.gorillawalker.com/you-call-we-haul-working-for-myself-series.pdf
    • http://www.gorillawalker.com/ecocriticism-and-women-writers-environmentalist-poetics-of-virginia-woolf-jeanette.pdf
    • http://www.gorillawalker.com/the-assistant-professor.pdf
    • http://www.gorillawalker.com/mi-libro-magico-my-magic-book-spanish-edition.pdf
    • http://www.gorillawalker.com/what-s-your-name-and-other-poems.pdf
    • http://www.gorillawalker.com/konmentaru-juvenile-law-2013-isbn-4877985387-japanese-import.pdf
    • http://www.gorillawalker.com/making-great-impressions-projects-uniting-rubber-stamping-with-polymer-clay.pdf
    • http://www.gorillawalker.com/young-goodman-brown-and-other-short-stories-dover-thrift-editions.pdf
    • http://www.gorillawalker.com/the-house-on-maple-street.pdf
    • http://www.gorillawalker.com/drawing-and-perceiving-second-edition.pdf
    • http://www.gorillawalker.com/on-the-screen-on-the-air-on-my-mind-kindle.pdf
    • http://www.gorillawalker.com/robotics-and-mechatronics-proceedings-of-the-4th-iftomm-international-symposium.pdf
    • http://www.gorillawalker.com/the-mayor-of-casterbridge-penguin-classics.pdf
    • http://www.gorillawalker.com/faust-bantam-classics-part-i-english-and-german-edition.pdf
    • http://www.gorillawalker.com/orcad-pspice-for-windows-volume-iii-digital-and-data-communications.pdf
    • http://www.gorillawalker.com/enteroimmunology-a-guide-to-prevention-and-treatment-of-chronic-disease.pdf
    • http://www.gorillawalker.com/czeslaw-milosz-and-the-insufficiency-of-lyric.pdf
    • http://www.gorillawalker.com/josh-a-boy-with-dyslexia.pdf
    • http://www.gorillawalker.com/the-networked-nonprofit-connecting-with-social-media-to-drive-change.pdf
    • http://www.gorillawalker.com/windows-10-superguide-beginner-to-expert-with-no-prior-experience.pdf
    • http://www.gorillawalker.com/dna-and-social-networking-a-guide-to-genealogy-in-the.pdf
    • http://www.gorillawalker.com/biblical-natural-science-v2-biblical-natural-science-v2-being-the.pdf
    • http://www.gorillawalker.com/fundamentals-of-school-library-media-management-a-how-to-do.pdf
    • http://www.gorillawalker.com/prc-supporting-the-consumer-protection-law-article-4-edition-paperback.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.