Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c3a6cec0dfa9a19…

MALICIOUS

PDF

41.9 KB Created: 2018-11-14 11:21:11 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 9.3.2 (Windows))
MD5: 3cf5291eb02b557458d1cdce7611f7c1 SHA-1: f8e97a39080435013b4b3f17ff01dcbda0dc4331 SHA-256: 2c3a6cec0dfa9a197418df9df8a2673a1774494a6a2ea740ceed97e471fa41e2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be to direct users to a large collection of documents hosted on www.gorillawalker.com, likely for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8698

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/draw-with-joan-miro.pdf
    • http://www.gorillawalker.com/42-rules-for-saving-your-house-from-foreclosure-a-practical.pdf
    • http://www.gorillawalker.com/mathematics-for-new-speakers-of-english.pdf
    • http://www.gorillawalker.com/backcountry-fly-fishing-in-salt-water.pdf
    • http://www.gorillawalker.com/school-of-mischief-8-magic-puppy.pdf
    • http://www.gorillawalker.com/ana-frank-diario-anne-frank-diary-of-a-young-girl.pdf
    • http://www.gorillawalker.com/leip-forward.pdf
    • http://www.gorillawalker.com/mum-in-a-million.pdf
    • http://www.gorillawalker.com/sabbath-day-all-the-bible-teaches-about-kindle-edition.pdf
    • http://www.gorillawalker.com/the-game-part-1.pdf
    • http://www.gorillawalker.com/rumblee-in-my-tummy-kindle-edition.pdf
    • http://www.gorillawalker.com/comprehension-processes-in-reading.pdf
    • http://www.gorillawalker.com/billy-the-bus-an-infant-musical.pdf
    • http://www.gorillawalker.com/an-introduction-to-time-series-analysis-and-forecasting-with-applications.pdf
    • http://www.gorillawalker.com/hong-kong-flexi-map.pdf
    • http://www.gorillawalker.com/elements-of-structural-geology-1963-483-pages.pdf
    • http://www.gorillawalker.com/aphid-management-in-alfalfa-for-wyoming.pdf
    • http://www.gorillawalker.com/finite-group-theory-cambridge-studies-in-advanced-mathematics.pdf
    • http://www.gorillawalker.com/morning-pilates-workouts.pdf
    • http://www.gorillawalker.com/the-teachings-of-freemasonry.pdf
    • http://www.gorillawalker.com/the-revenge-game-a-tale-of-domination-and-seduction-volume.pdf
    • http://www.gorillawalker.com/economic-freedom-lessons-of-hong-kong.pdf
    • http://www.gorillawalker.com/love-doesn-t-cost-a-thing-connecting-hearts-paperback.pdf
    • http://www.gorillawalker.com/sap-r-3-quality-management-making-it-work-for-your.pdf
    • http://www.gorillawalker.com/single-parenting-eliminating-guilt-and-excuses-and-being-a-great.pdf
    • http://www.gorillawalker.com/the-works-of-john-wesley-volume-23-journal-and-diaries.pdf
    • http://www.gorillawalker.com/salvation-tomorrow.pdf
    • http://www.gorillawalker.com/irresistible-delroi-prophecy-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/the-outlaw-s-bible-how-to-evade-the-system-using.pdf
    • http://www.gorillawalker.com/smaragdus-of-saint-mihiel-the-crown-of-monks-cistercian-studies.pdf
    • http://www.gorillawalker.com/the-puzzling-world-of-winston-breen-puzzling-world-winston-breen.pdf
    • http://www.gorillawalker.com/rave-america-new-school-dancescapes.pdf
    • http://www.gorillawalker.com/clep-history-of-the-united-states-ii-1865-to-the.pdf
    • http://www.gorillawalker.com/the-arrangement-3-die-familie-ferro-german-edition.pdf
    • http://www.gorillawalker.com/sex-and-eroticism-in-mesopotamian-literature.pdf
    • http://www.gorillawalker.com/verf-hrerische-verstrickungen-german-edition.pdf
    • http://www.gorillawalker.com/the-chiropractor-s-self-help-back-and-body-book-your.pdf
    • http://www.gorillawalker.com/an-arabic-english-lexicon-in-eight-volumes-vol-i-derived.pdf
    • http://www.gorillawalker.com/decorative-dollhouses.pdf
    • http://www.gorillawalker.com/samurai-sudoku-hard-volume-4-159-puzzles.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.