Malicious PDF — malware analysis report

Static analysis result for SHA-256 25a45cb5dc8c357e…

MALICIOUS

PDF

42.7 KB Created: 2019-03-18 18:23:43 +03:00 Authoring application: Adobe InDesign CS4 (6.0.6) (via Mac OS X 10.9.1 Quartz PDFContext)
MD5: 0e5f906258b0b1e2215612c4526daaf1 SHA-1: 2061f3608846b1a84d42eee8719a86a550657e4a SHA-256: 25a45cb5dc8c357e59b059dbf0404260b0bb8e6db11c605b19de4d24bcfa3611
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'www.gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/advantages-of-the-city-of-council-bluffs-iowa-for-those.pdf
    • http://www.gorillawalker.com/swat-team-two-and-miss-robin-hood-the-men-of.pdf
    • http://www.gorillawalker.com/ophthalmic-lasers-photocoagulation-photoradiation-and-surgery.pdf
    • http://www.gorillawalker.com/imperial-russian-field-uniforms-and-equipment-1907-1917.pdf
    • http://www.gorillawalker.com/things-a-little-bird-told-me-confessions-of-the-creative.pdf
    • http://www.gorillawalker.com/deviant-kindle-edition.pdf
    • http://www.gorillawalker.com/vietnam-veterans-homecoming-crossing-the-line.pdf
    • http://www.gorillawalker.com/mtawa-mweusi.pdf
    • http://www.gorillawalker.com/insights-a-laboratory-manual-for-physical-and-historical-geology.pdf
    • http://www.gorillawalker.com/the-liver-cleansing-diet-by-sandra-cabot-m-d-dec.pdf
    • http://www.gorillawalker.com/reforming-the-un-the-challenge-of-working-together.pdf
    • http://www.gorillawalker.com/outside-in-my-dressing-gown-and-other-poems-for-garden.pdf
    • http://www.gorillawalker.com/tourmaline-a-monograph.pdf
    • http://www.gorillawalker.com/a-short-history-of-england-ireland-and-scotland.pdf
    • http://www.gorillawalker.com/fingame-5-0-participant-s-manual-with-registration-code-irwin.pdf
    • http://www.gorillawalker.com/egypt-before-the-pharaohs-the-prehistoric-foundation-of-egyptian-civilization.pdf
    • http://www.gorillawalker.com/planning-the-perfect-party-a-guide-to-successful-entertaining.pdf
    • http://www.gorillawalker.com/recent-advances-in-maintenance-and-infrastructure-management.pdf
    • http://www.gorillawalker.com/time-lord-the-remarkable-canadian-who-missed-his-train-and.pdf
    • http://www.gorillawalker.com/de-gruchy-orienting-arthur-waley.pdf
    • http://www.gorillawalker.com/relativistic-kinetic-theory-principles-and-applications.pdf
    • http://www.gorillawalker.com/boys-into-men-staying-healthy-through-the-teen-years.pdf
    • http://www.gorillawalker.com/the-tuned-in-turned-on-book-about-learning-problems.pdf
    • http://www.gorillawalker.com/science-of-love-the-wisdom-of-well-being.pdf
    • http://www.gorillawalker.com/story-of-the-bible-animals-300-illustrated-animals.pdf
    • http://www.gorillawalker.com/the-easy-way-to-walk-in-the-spirit-hearing-god.pdf
    • http://www.gorillawalker.com/grammar-for-writing-level-gold-complete-course.pdf
    • http://www.gorillawalker.com/chinese-foreign-exchange-reserves-grew-huang-xiaodong-08-printed-chinese.pdf
    • http://www.gorillawalker.com/farming-with-native-beneficial-insects-ecological-pest-control-solutions.pdf
    • http://www.gorillawalker.com/archie-in-the-crosshairs-the-nero-wolfe-mysteries.pdf
    • http://www.gorillawalker.com/should-a-christian-be-a-mason.pdf
    • http://www.gorillawalker.com/aircraft-pictures-vol-9-classic-and-antique-aircraft-kindle-edition.pdf
    • http://www.gorillawalker.com/human-tales.pdf
    • http://www.gorillawalker.com/global-marketing.pdf
    • http://www.gorillawalker.com/hydraulic-transients.pdf
    • http://www.gorillawalker.com/europe-since-1914-encyclopedia-of-the-age-war-and-reconstruction.pdf
    • http://www.gorillawalker.com/unternehmen-deutsch-arbeitsheft.pdf
    • http://www.gorillawalker.com/the-case-for-a-creator-student-edition-a-journalist-investigates.pdf
    • http://www.gorillawalker.com/charging-for-government-routledge-revivals-user-charges-and-earmarked-taxes.pdf
    • http://www.gorillawalker.com/peche-eau-calme-et-nature-bonne-peche-pecher-dans-un.pdf
    • http://www.gorillaw
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.