Malicious PDF — malware analysis report

Static analysis result for SHA-256 26fa359e2c73f48c…

MALICIOUS

PDF

43.8 KB Created: 2018-12-15 08:11:24 +03:00 Authoring application: DVIPSONE 2.2.4 http://www.YandY.com (via Acrobat Distiller 7.0.5 (Windows))
MD5: caf64118ada17a5a320024123d302721 SHA-1: 9ae53fdef5e6e024c7a3346a198d6d9a30f4ff7c SHA-256: 26fa359e2c73f48c6da878e7ec080cde38c2ec21559486e1e5011016f130b04f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, characteristic of a link farm or SEO manipulation tactic. The primary purpose appears to be directing users to a collection of PDF documents hosted on gorillawalker.com, likely as a form of content spam or to obscure malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/cartooning-for-beginners-a-step-by-step-guide-to-drawing.pdf
    • http://www.gorillawalker.com/the-language-of-less-then-and-now-museum-of-contemporary.pdf
    • http://www.gorillawalker.com/pathfinder-chronicles-rise-of-the-runelords-map-folio-by-rob.pdf
    • http://www.gorillawalker.com/santorini-guide-2004-your-guide-to-enjoying-the-island-athinorama.pdf
    • http://www.gorillawalker.com/compassion-living-in-the-spirit-of-st-francis.pdf
    • http://www.gorillawalker.com/a-mom-s-guide-to-life-after-divorce-move-forward.pdf
    • http://www.gorillawalker.com/the-gardens-of-suzhou-penn-studies-in-landscape-architecture.pdf
    • http://www.gorillawalker.com/caffeine-blues-wake-up-to-the-hidden-dangers-of-america.pdf
    • http://www.gorillawalker.com/image-processing-and-analysis-with-graphs-theory-and-practice-digital.pdf
    • http://www.gorillawalker.com/galois-theory-for-beginners-a-historical-perspective-student-mathematical-library.pdf
    • http://www.gorillawalker.com/lithuanian-bible-canonical-edition-brown-leather-bound-with-zipper-golden.pdf
    • http://www.gorillawalker.com/native-and-newcomer.pdf
    • http://www.gorillawalker.com/science-learning-objectives-essential-tools-high-school-for-use-with.pdf
    • http://www.gorillawalker.com/delicious-traditional-amish-cooking-learn-how-to-cook-the-amish.pdf
    • http://www.gorillawalker.com/mastering-the-essentials-of-residential-real-estate-trends-challenges-and.pdf
    • http://www.gorillawalker.com/little-critter-sports-fun-with-little-critter.pdf
    • http://www.gorillawalker.com/the-grasshopper-the-ants.pdf
    • http://www.gorillawalker.com/the-master-scratch-builders-their-aircraft-models-techniques-schiffer-military.pdf
    • http://www.gorillawalker.com/klezmer-triptych-for-saxophone-quartet-by-mike-curtis.pdf
    • http://www.gorillawalker.com/transportation-map-of-xinjiang-gansu-province-qinghai-province-and-tibet.pdf
    • http://www.gorillawalker.com/danger-at-the-dieselworks-thomas-friends-pictureback-r.pdf
    • http://www.gorillawalker.com/biology-benjamin-cummings-series-in-the-life-sciences.pdf
    • http://www.gorillawalker.com/bad-kitty-chronicles-of-the-malcolm.pdf
    • http://www.gorillawalker.com/hello-dolly-vocal-score.pdf
    • http://www.gorillawalker.com/i-need-a-vacation-musical-showtrax-cd.pdf
    • http://www.gorillawalker.com/exploring-adobe-indesign-cs5-design-exploration-series.pdf
    • http://www.gorillawalker.com/across-the-dark-islands.pdf
    • http://www.gorillawalker.com/the-first-americans-chester-the-crab-s-comics-with-content.pdf
    • http://www.gorillawalker.com/let-me-gaze-on-the-vision-from-faust-opera-vocal.pdf
    • http://www.gorillawalker.com/fichte-s-republic-idealism-history-and-nationalism.pdf
    • http://www.gorillawalker.com/dancing-for-degas-a-novel.pdf
    • http://www.gorillawalker.com/the-nuts-and-bolts-of-cardiac-pacing.pdf
    • http://www.gorillawalker.com/drawing-shojo-manga-vol-1.pdf
    • http://www.gorillawalker.com/voces-de-espana-antologia-literaria-spanish-edition.pdf
    • http://www.gorillawalker.com/serbia-s-great-war-1914-1918-central-european-studies.pdf
    • http://www.gorillawalker.com/strengthening-your-singing-voice.pdf
    • http://www.gorillawalker.com/in-this-sign-conquer-a-history-of-the-society-of.pdf
    • http://www.gorillawalker.com/expeditions-in-your-classroom-english-language-arts-for-common-core.pdf
    • http://www.gorillawalker.com/sinn-fein-and-the-politics-of-left-republicanism-irish-left.pdf
    • http://www.gorillawalker.com/cyclotomic-fields-i-and-ii-graduate-texts-in-mathematics-v.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://www.YandY.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.