Malicious PDF — malware analysis report

Static analysis result for SHA-256 2107ee02f014714d…

MALICIOUS

PDF

42.6 KB Created: 2018-11-15 18:32:30 +03:00 Authoring application: Microsoft Word: AdobePS 8.7.3 (301) (via Acrobat Distiller 5.0.5 for Macintosh)
MD5: 22df76cc7281bfccfb3e294a86771cc3 SHA-1: 65580aed46c17ba9bf9a8a8d7d34744dab47b558 SHA-256: 2107ee02f014714d509fe2c315dd105ad0d9745342647fb1dadff215ce06bd9e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to other PDF documents on the domain www.gorillawalker.com. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute a variety of malicious content. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-1999-picture-price-guide.pdf
    • http://www.gorillawalker.com/big-squeeze-ranch-3.pdf
    • http://www.gorillawalker.com/linguistic-human-rights-overcoming-linguistic-discrimination-contributions-to-sociology-of.pdf
    • http://www.gorillawalker.com/structural-equation-modeling-with-lisrel-prelis-and-simplis-basic-concepts.pdf
    • http://www.gorillawalker.com/student-study-guide-to-accompany-a-first-course-in-complex.pdf
    • http://www.gorillawalker.com/digital-art-its-arts-and-science.pdf
    • http://www.gorillawalker.com/precious-memories.pdf
    • http://www.gorillawalker.com/accidental-sorceress-hardstorm-saga-book-2.pdf
    • http://www.gorillawalker.com/el-rev-s-y-el-derecho-discurso-de-suecia-the.pdf
    • http://www.gorillawalker.com/irrigation-of-agricultural-crops-agronomy.pdf
    • http://www.gorillawalker.com/the-international-journal-of-the-inclusive-museum-volume-3-number.pdf
    • http://www.gorillawalker.com/a-familiar-exposition-of-the-constitution-of-the-united-states.pdf
    • http://www.gorillawalker.com/smart-guide-to-managing-your-time.pdf
    • http://www.gorillawalker.com/la-mort-d-agrippine-french-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/musical-chairs.pdf
    • http://www.gorillawalker.com/mcdougal-littell-biology-michigan-student-edition-grades-9-12-2009.pdf
    • http://www.gorillawalker.com/economic-applications-of-quantile-regression-studies-in-empirical-economics.pdf
    • http://www.gorillawalker.com/crop-project-volume-1-deep-seismic-exploration-of-the-central.pdf
    • http://www.gorillawalker.com/wheels-of-steel-boxed-set-books-1-3.pdf
    • http://www.gorillawalker.com/just-the-facts-a-novel.pdf
    • http://www.gorillawalker.com/the-honeymooners-companion.pdf
    • http://www.gorillawalker.com/death-by-pad-thai-and-other-unforgettable-meals.pdf
    • http://www.gorillawalker.com/amelia-earhart-heinemann-profiles.pdf
    • http://www.gorillawalker.com/it-s-not-easy-bein-me-a-lifetime-of-no.pdf
    • http://www.gorillawalker.com/butterfield-butterfield-san-francisco-american-european-prints-contemporary-art-vol.pdf
    • http://www.gorillawalker.com/seabirds-kindle-edition.pdf
    • http://www.gorillawalker.com/the-theory-of-classes-of-groups-mathematics-and-its-applications.pdf
    • http://www.gorillawalker.com/mexico-rebelde-spanish-edition.pdf
    • http://www.gorillawalker.com/florida-s-birds-of-prey.pdf
    • http://www.gorillawalker.com/if-your-mind-wanders-at-mass.pdf
    • http://www.gorillawalker.com/best-day-of-my-life-piano-vocal-guitar-sheet.pdf
    • http://www.gorillawalker.com/red-shambhala-magic-prophecy-and-geopolitics-in-the-heart-of.pdf
    • http://www.gorillawalker.com/the-ultimate-guide-to-pilates-nutrition-maximize-your-potential-unabridged.pdf
    • http://www.gorillawalker.com/give-it-to-them-jersey-blues-a-history-of-the.pdf
    • http://www.gorillawalker.com/a-dictionary-of-sociology-oxford-dictionary-of-sociology.pdf
    • http://www.gorillawalker.com/a-sense-of-belonging-from-castro-s-cuba-to-the.pdf
    • http://www.gorillawalker.com/spiritual-wholeness-for-clergy-a-new-psychology-of-intimacy-with.pdf
    • http://www.gorillawalker.com/rock-climbing-outdoor-adventures-series-1st-first-edition-by-wilderness.pdf
    • http://www.gorillawalker.com/italian-army-elite-units-and-special-forces-1940-43.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.