Malicious PDF — malware analysis report

Static analysis result for SHA-256 244322c67ccd0cbe…

MALICIOUS

PDF

40.7 KB Created: 2018-12-14 20:35:38 +03:00 Authoring application: Microsoft Word (via Mac OS X 10.6.8 Quartz PDFContext)
MD5: 34552b7df72e7114896007cfa226174f SHA-1: 9eb9a605c690876b4f02c95182d72fc1fe226548 SHA-256: 244322c67ccd0cbe4e12bbe5624cebcf64aebd3b7e3815dae5938ea6dc3de0cd
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-power-of-ethical-management.pdf
    • http://www.gorillawalker.com/standard-estimating-practice-american-society-of-professional-estimators.pdf
    • http://www.gorillawalker.com/learn-to-program-with-java-learn-to-program-with-professor.pdf
    • http://www.gorillawalker.com/scrabble-fun-reading-rocket-blast-off-primary-level.pdf
    • http://www.gorillawalker.com/immortalis-amor-darkest-secrets.pdf
    • http://www.gorillawalker.com/about-faces.pdf
    • http://www.gorillawalker.com/summer-bridge-activities-activity-cards-grades-k-1.pdf
    • http://www.gorillawalker.com/lo-que-debe-saber-sobre-los-primeros-auxilios-y-la.pdf
    • http://www.gorillawalker.com/independence-an-argument-for-home-rule.pdf
    • http://www.gorillawalker.com/harem-ring-books-1-5-bundle-kindle-edition.pdf
    • http://www.gorillawalker.com/anatomy-of-the-quran.pdf
    • http://www.gorillawalker.com/getting-started-with-c-audio-programming-for-game-development.pdf
    • http://www.gorillawalker.com/chopin-mazurka-op-7-no-5-instantly-download-and-print.pdf
    • http://www.gorillawalker.com/fat-poets-speak-2-living-and-loving-fatly.pdf
    • http://www.gorillawalker.com/student-solutions-manual-engineering-statistics-5e.pdf
    • http://www.gorillawalker.com/in-a-people-house-bright-and-early-books.pdf
    • http://www.gorillawalker.com/biscuit-cookie-and-cracker-manufacturing-manuals-complete-set-of-6.pdf
    • http://www.gorillawalker.com/the-yorkshire-dictionary-of-dialect-tradition-and-folklore.pdf
    • http://www.gorillawalker.com/an-introduction-to-deontic-logic.pdf
    • http://www.gorillawalker.com/us-army-technical-manual-tm-5-4310-352-24p-organizational.pdf
    • http://www.gorillawalker.com/merton-an-enneagram-profile.pdf
    • http://www.gorillawalker.com/varieties-of-narrative-analysis.pdf
    • http://www.gorillawalker.com/billy-cannon-a-long-long-run.pdf
    • http://www.gorillawalker.com/personality-priorities-a-typology.pdf
    • http://www.gorillawalker.com/counseling-theories-for-human-services-practitioners-essential-concepts-and-applications.pdf
    • http://www.gorillawalker.com/dead-and-gone-classic-crimes-of-north-carolina.pdf
    • http://www.gorillawalker.com/the-journey-of-becoming-a-mother-among-women-in-northern.pdf
    • http://www.gorillawalker.com/mel-bay-electric-bass-position-studies.pdf
    • http://www.gorillawalker.com/paranormal-university-demon-bound-new-adult-occult-m-nage-erotica.pdf
    • http://www.gorillawalker.com/living-off-the-country-how-to-stay-alive-in-tthe.pdf
    • http://www.gorillawalker.com/nelson-mandela-young-reading-series-three.pdf
    • http://www.gorillawalker.com/computing-from-the-abacus-to-the-ipad-computing-and-connecting.pdf
    • http://www.gorillawalker.com/time-to-pray-series-prayers-from-the-bible.pdf
    • http://www.gorillawalker.com/us-army-technical-manual-tm-5-3895-330-10-spreader.pdf
    • http://www.gorillawalker.com/chansons-de-roland-po-sie-french-edition.pdf
    • http://www.gorillawalker.com/monaco-sights-a-travel-guide-to-the-top-15-attractions.pdf
    • http://www.gorillawalker.com/here-comes-the-bride-looking-for-love.pdf
    • http://www.gorillawalker.com/a-guide-to-the-identification-of-the-genera-of-bacteria.pdf
    • http://www.gorillawalker.com/down-low-in-the-end-zone-2-m-m-gay.pdf
    • http://www.gorillawalker.com/pie-80-pies-and-pastry-delights-by-brettschneider-dean-2013.pdf
    • http://www.gorillawalker.com/lo-que-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.