Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a0ffb4c5e9c0f29…

MALICIOUS

PDF

42.0 KB Created: 2018-12-07 18:29:00 +03:00 Authoring application: Adobe PageMaker 7.0 (via Acrobat Distiller 5.0.5 (Windows))
MD5: 2b7cd2ca477e790cd9e6d8e1ad754d38 SHA-1: b4defd1b92b6fe56cc7417e3738cf717baab509a SHA-256: 2a0ffb4c5e9c0f29277e47a54b9124519e360e5bee75d5e961f3a49cb51bacd5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links. These links, predominantly pointing to PDF files on 'gorillawalker.com', suggest a link farm or a method to distribute malicious content. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/webtutor-tm-on-blackboard-printed-access-card-for-miller-urisko.pdf
    • http://www.gorillawalker.com/hello-mariner-moose.pdf
    • http://www.gorillawalker.com/blood-the-maddie-trilogy-kindle-edition.pdf
    • http://www.gorillawalker.com/taking-karre-divinity-warriors-book-4-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/highlander-s-ransom-kindle-edition.pdf
    • http://www.gorillawalker.com/sarah-elizabeth-plans-a-tea-party.pdf
    • http://www.gorillawalker.com/the-whole-armor-the-truth-about-lies-kindle-edition.pdf
    • http://www.gorillawalker.com/biologia-biology-la-unidad-y-diversidad-de-la-vida-spanish.pdf
    • http://www.gorillawalker.com/contemporary-hispanic-biography-vol-4.pdf
    • http://www.gorillawalker.com/husbands-and-fathers-re-discover-the-creator-s-purpose-for.pdf
    • http://www.gorillawalker.com/the-magical-world-of-the-inklings.pdf
    • http://www.gorillawalker.com/london-under-london-a-subterranean-guide.pdf
    • http://www.gorillawalker.com/breeze-easy-method-for-french-horn-bk-1-cassette-breeze.pdf
    • http://www.gorillawalker.com/the-christmas-magic.pdf
    • http://www.gorillawalker.com/spelling-practice-book-grade-1-trophies.pdf
    • http://www.gorillawalker.com/introduction-to-sport-marketing-sport-management.pdf
    • http://www.gorillawalker.com/what-s-wrong-with-sociology.pdf
    • http://www.gorillawalker.com/sex-and-sunsets-a-novel.pdf
    • http://www.gorillawalker.com/pop-goes-the-weasel-di-helen-grace-2-a-di.pdf
    • http://www.gorillawalker.com/gandhi-icons-history-makers-paperback.pdf
    • http://www.gorillawalker.com/mel-bay-secrets-of-the-greats-drumset-exercises-for-a.pdf
    • http://www.gorillawalker.com/bonhoeffer-and-interpretive-theory-essays-on-methods-and-understanding-international.pdf
    • http://www.gorillawalker.com/or-perish-in-the-attempt-wilderness-medicine-in-the-lewis.pdf
    • http://www.gorillawalker.com/management-and-cost-accounting-with-myaccountinglab.pdf
    • http://www.gorillawalker.com/the-westminster-historical-atlas-to-the-bible-westminster-aids-to.pdf
    • http://www.gorillawalker.com/flame-of-recca-vol-27.pdf
    • http://www.gorillawalker.com/tokyo-journal-volume-32-issue-271.pdf
    • http://www.gorillawalker.com/cutting-edge-internal-auditing.pdf
    • http://www.gorillawalker.com/las-ense-anazas-de-los-esenios-desde-enoch-hasta-los.pdf
    • http://www.gorillawalker.com/how-to-search-for-a-pastor-in-todays-church.pdf
    • http://www.gorillawalker.com/the-voices-of-the-prophets-kindle-edition.pdf
    • http://www.gorillawalker.com/releasing-the-power-of-the-prophetic-a-practical-guide-to.pdf
    • http://www.gorillawalker.com/an-introduction-to-partial-differential-equations-with-matlab-chapman-hall.pdf
    • http://www.gorillawalker.com/educare-alla-sessualit.pdf
    • http://www.gorillawalker.com/lesourdsville-lake-amusement-park-images-of-america-series.pdf
    • http://www.gorillawalker.com/oscar-wilde-s-decorated-books-editorial-theory-and-literary-criticism.pdf
    • http://www.gorillawalker.com/george-and-martha-washington-portraits-from-the-presidential-years.pdf
    • http://www.gorillawalker.com/studies.pdf
    • http://www.gorillawalker.com/evangelho-de-mateus-o-rei-carpinteiro-li-es-de-vida.pdf
    • http://www.gorillawalker.com/paralegal-career-guide.pdf
    • http://www.gorillawalker.com/husbands-and-fathe
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.