Malicious PDF — malware analysis report

Static analysis result for SHA-256 2567689dd6a58480…

MALICIOUS

PDF

32.3 KB Created: 2020-01-17 19:20:07 +03:00 Authoring application: Arbortext Publishing Engine (via PDFlib+PDI 8.0.2p1 (Win32))
MD5: 440343adedef2fb7a5654c11e05c2b53 SHA-1: 9399877d995aaa88ffc14ad054537815d7595fe1 SHA-256: 2567689dd6a5848087cd21aedd5c524060d342a9774915c466dbf77340739835
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious. The primary attack pattern observed is the distribution of a link farm, likely intended to direct users to potentially harmful content hosted on the 'gorillawalker.com' domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8008

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-shroud-for-aquarius-a-mallory-novel.pdf
    • http://www.gorillawalker.com/batman-year-one.pdf
    • http://www.gorillawalker.com/toby-and-the-secrets-of-the-tree.pdf
    • http://www.gorillawalker.com/dave-perry-s-100-best-racing-rules-quizzes.pdf
    • http://www.gorillawalker.com/the-kwagh-hir-theater-a-weapon-for-social-action.pdf
    • http://www.gorillawalker.com/undomesticated-ground-recasting-nature-as-feminist-space.pdf
    • http://www.gorillawalker.com/strip-club-tales-olivia.pdf
    • http://www.gorillawalker.com/preserve-it-naturally-a-complete-guide-to-food-dehydration.pdf
    • http://www.gorillawalker.com/be-it-ever-so-humble.pdf
    • http://www.gorillawalker.com/apocrypha-arabica-cambridge-library-collection-biblical-studies.pdf
    • http://www.gorillawalker.com/econometrics-statistical-foundations-and-applications.pdf
    • http://www.gorillawalker.com/secrets-of-stonehenge.pdf
    • http://www.gorillawalker.com/go-ask-malice-a-slayer-s-diary-buffy-the-vampire.pdf
    • http://www.gorillawalker.com/acts-of-charity.pdf
    • http://www.gorillawalker.com/current-trends-in-the-embryology-of-angiosperms.pdf
    • http://www.gorillawalker.com/practical-surgical-pathology-integrating-molecular-pathology-into-your-morphologic-practice.pdf
    • http://www.gorillawalker.com/how-to-build-power-tune-su-carburetors-speedpro-speedpro-series.pdf
    • http://www.gorillawalker.com/working-with-adolescents-constructing-identity-master-classes-in-education-series.pdf
    • http://www.gorillawalker.com/the-tortoise-diaries-daily-meditations-for-creativity-and-slowing-down.pdf
    • http://www.gorillawalker.com/sailboat-refinishing-international-marine-sailboat-library.pdf
    • http://www.gorillawalker.com/stuck-on-stupid-4-game-over.pdf
    • http://www.gorillawalker.com/ontogeny-of-the-immune-system-chemical-immunology-allergy-v-29.pdf
    • http://www.gorillawalker.com/hokusai-and-hiragana-the-views-of-mount-fuji-with-hiragana.pdf
    • http://www.gorillawalker.com/abc-sticker-activity-first-steps.pdf
    • http://www.gorillawalker.com/bluegrass-fakebook-150-all-time-favorites-seventh-edition.pdf
    • http://www.gorillawalker.com/what-really-happened-in-ancient-times-a-collection-of-historical.pdf
    • http://www.gorillawalker.com/una-luz-incierta-ficci-n-ya-spanish-edition.pdf
    • http://www.gorillawalker.com/jelly-s-last-jam.pdf
    • http://www.gorillawalker.com/arte-de-la-iphoneografia-iphoneography-art-spanish-edition.pdf
    • http://www.gorillawalker.com/solving-ordinary-differential-equations-ii-stiff-and-differential-algebraic-problems.pdf
    • http://www.gorillawalker.com/planning-models-classics-in-planning.pdf
    • http://www.gorillawalker.com/drifting-continents-shifting-seas-an-introduction-to-plate-tectonics.pdf
    • http://www.gorillawalker.com/the-zebra-lounge-first-visit-the-zebra-lounge-series-book.pdf
    • http://www.gorillawalker.com/nullarbor-kid.pdf
    • http://www.gorillawalker.com/write-tight-how-to-keep-your-prose-sharp-focused-and.pdf
    • http://www.gorillawalker.com/radical-self-acceptance-a-buddhist-guide-to-freeing-yourself-from.pdf
    • http://www.gorillawalker.com/the-lady-of-the-lake-kindle-edition.pdf
    • http://www.gorillawalker.com/492-great-things-about-being-italian.pdf
    • http://www.gorillawalker.com/pictorial-encyclopedia-of-modern-cake-decorating.pdf
    • http://www.gorillawalker.com/wealth-matters-makeover-edition-rebuild-and-restore-your-life-victorious.pdf
    • http://www.gorillawalker.com/current-trends-in-the-e
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.