Malicious PDF — malware analysis report

Static analysis result for SHA-256 24e41e71c1099a2f…

MALICIOUS

PDF

43.1 KB Created: 2019-03-17 02:58:22 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.4)
MD5: a6cafa3c08e3eb4ac3e33569f313ff95 SHA-1: d138b16dd1eb6db2e1febcf9f4501f3ab54b61c9 SHA-256: 24e41e71c1099a2f9b92150e447750ad00db27f22807f922e6860a684a23e814
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, primarily hosted on 'www.gorillawalker.com'. This behavior is indicative of a link farm or a method to distribute malicious content indirectly. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/israel-s-anointing-your-inheritance-and-end-time-destiny-through.pdf
    • http://www.gorillawalker.com/happy-birthday-cake-with-candles-postcard-package-of-25.pdf
    • http://www.gorillawalker.com/write-source-skillsbook-consumable-grade-3.pdf
    • http://www.gorillawalker.com/case-studies-in-oncology-nursing-text-and-review.pdf
    • http://www.gorillawalker.com/research-methods-for-generalist-social-work-sw-388r-1-research.pdf
    • http://www.gorillawalker.com/the-ulysses-theme-a-study-in-the-adaptability-of-a.pdf
    • http://www.gorillawalker.com/introduction-to-differential-geometry-and-riemannian-geometry-mathematical-expositions.pdf
    • http://www.gorillawalker.com/the-lavender-gourmet-culinary-recipes-for-entertaining-and-every-day.pdf
    • http://www.gorillawalker.com/candy-rubenesque-book-1.pdf
    • http://www.gorillawalker.com/hepplewhite-sheraton-and-regency-furniture.pdf
    • http://www.gorillawalker.com/11-maths-questions-100-foundation-questions-11-plus-maths.pdf
    • http://www.gorillawalker.com/julius-caesar-barron-s-book-notes.pdf
    • http://www.gorillawalker.com/carol-vorderman-s-times-tables-made-easy-reissues-education-2014.pdf
    • http://www.gorillawalker.com/black-orchid.pdf
    • http://www.gorillawalker.com/ciudad-y-territorio-entre-los-mayas-historia-de-las-teorias.pdf
    • http://www.gorillawalker.com/christmas-in-the-dominican-republic-kindle-edition.pdf
    • http://www.gorillawalker.com/success-wealth-through-the-bible.pdf
    • http://www.gorillawalker.com/symposium-on-paleolimnology-1969-communications-mitteilungen-of-the-international-association.pdf
    • http://www.gorillawalker.com/maisy-s-abc.pdf
    • http://www.gorillawalker.com/the-essential-guide-to-divorce.pdf
    • http://www.gorillawalker.com/code-of-federal-regulations-title-47-telecommunication-pt-20-39.pdf
    • http://www.gorillawalker.com/also-sprach-zarathustra-op-30-oboe-1-2-and-3.pdf
    • http://www.gorillawalker.com/el-cementerio-de-praga-spanish-edition.pdf
    • http://www.gorillawalker.com/the-goon-show-the-indigestion-waltz-four-original-bbc-radio.pdf
    • http://www.gorillawalker.com/the-seventh-report-of-the-joint-national-committee-on-prevention.pdf
    • http://www.gorillawalker.com/death-s-sweet-song-whom-gods-destroy-stark-house-noir.pdf
    • http://www.gorillawalker.com/whatever-happened-to-the-gospel-of-grace-rediscovering-the-doctrines.pdf
    • http://www.gorillawalker.com/the-character-of-democracy-how-institutions-shape-politics.pdf
    • http://www.gorillawalker.com/the-collected-short-stories-of-louis-l-amour-volume-5.pdf
    • http://www.gorillawalker.com/personal-injury-and-wrongful-death-damages-calculations-transatlantic-dialogue-contemporary.pdf
    • http://www.gorillawalker.com/the-5-2-cookbook-100-recipes-for-fasting.pdf
    • http://www.gorillawalker.com/dawn-of-the-bunny-suicides.pdf
    • http://www.gorillawalker.com/teach-yourself-game-programming-in-21-days-book-and-cd.pdf
    • http://www.gorillawalker.com/meerkats-are-awesome-awesome-african-animals.pdf
    • http://www.gorillawalker.com/the-vertical-farm-feeding-the-world-in-the-21st-century.pdf
    • http://www.gorillawalker.com/lottery-master-guide.pdf
    • http://www.gorillawalker.com/worker-safety-and-labor-rights-in-bangladesh-s-garment-sector.pdf
    • http://www.gorillawalker.com/four-major-plays.pdf
    • http://www.gorillawalker.com/toxic-tourism-rhetorics-of-pollution-travel-and-environmental-justice-albma.pdf
    • http://www.gorillawalker.com/diccionario-esoterico-de-la-biblia-spanish-edition.pdf
    • http://www.gorill
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.