Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e309aa68f3f7fc3…

MALICIOUS

PDF

42.8 KB Created: 2018-11-23 08:06:16 +03:00 Authoring application: - (via Acrobat Distiller 7.0.5 (Windows))
MD5: 02914e61033f75f3a6ce88677da867ef SHA-1: 751d51b07c5c2afd2656c9f7d266c16358dc16d4 SHA-256: 2e309aa68f3f7fc343978b41bcdde897f973e9bffcc9b17bbdf2577db75f8f09
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier also flagged this PDF as malicious with a high probability.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/fibernoodles-cooking-with-shirataki-pasta-volume-2.pdf
    • http://www.gorillawalker.com/career-diary-of-a-caterer-gardner-s-guide-series.pdf
    • http://www.gorillawalker.com/advances-in-motivation-in-sport-exercise.pdf
    • http://www.gorillawalker.com/cream-for-comfort-an-adult-nursing-erotic-romance.pdf
    • http://www.gorillawalker.com/keeper.pdf
    • http://www.gorillawalker.com/kaizen-express-fundamentals-for-your-lean-journey.pdf
    • http://www.gorillawalker.com/guillermo-tell-spanish-edition.pdf
    • http://www.gorillawalker.com/introduction-to-diffraction-in-materials-science-and-engineering.pdf
    • http://www.gorillawalker.com/ancient-egypt-grades-4-7-a-comprehensive-resource-for-the.pdf
    • http://www.gorillawalker.com/to-experience-wonder-edna-staebler-a-life.pdf
    • http://www.gorillawalker.com/the-3-minute-book-spend-less-time-looking-for-answers.pdf
    • http://www.gorillawalker.com/deeper-into-diving.pdf
    • http://www.gorillawalker.com/the-return-of-rafe-mackade-the-mackade-brothers.pdf
    • http://www.gorillawalker.com/la-federacio-129-n-de-centroame-129-rica-sus-antecedentes.pdf
    • http://www.gorillawalker.com/national-security-law-fifth-edition-aspen-casebooks.pdf
    • http://www.gorillawalker.com/dear-america.pdf
    • http://www.gorillawalker.com/hot-gimmick-vol-12-v-12.pdf
    • http://www.gorillawalker.com/playing-out-of-your-mind-a-soccer-player-and-coaches.pdf
    • http://www.gorillawalker.com/logging-in-mason-county-images-of-america.pdf
    • http://www.gorillawalker.com/power-of-blackness-hawthorne-poe-melville.pdf
    • http://www.gorillawalker.com/genera-palmarum-the-evolution-and-classification-of-palms.pdf
    • http://www.gorillawalker.com/gardening-with-pooh-cheerful-poems-plus-planting-pointers.pdf
    • http://www.gorillawalker.com/where-does-the-money-go-rev-ed-your-guided-tour.pdf
    • http://www.gorillawalker.com/solo-flight-one-pilot-s-aviation-adventure-around-australia.pdf
    • http://www.gorillawalker.com/treating-victims-of-torture-and-violence-theoretical-cross-cultural-and.pdf
    • http://www.gorillawalker.com/dictionarul-etimologic-al-limbii-rom-ne-elementele-latine-volume-part.pdf
    • http://www.gorillawalker.com/applications-for-elementary-linear-algebra.pdf
    • http://www.gorillawalker.com/lord-john-and-the-brotherhood-of-the-blade.pdf
    • http://www.gorillawalker.com/hello-kitty-everywhere.pdf
    • http://www.gorillawalker.com/london-gothic-place-space-and-the-gothic-imagination-continuum-literary.pdf
    • http://www.gorillawalker.com/12-australian-insects-kids-book-about-insects-fun-animal-facts.pdf
    • http://www.gorillawalker.com/auto-insurance-and-claims-operations-guide-paperback.pdf
    • http://www.gorillawalker.com/african-short-stories-an-anthology.pdf
    • http://www.gorillawalker.com/garth-ennis-battlefields-volume-8-the-fall-and-rise-of.pdf
    • http://www.gorillawalker.com/mason-jar-meals-38-little-known-easy-healthy-delicious-mason.pdf
    • http://www.gorillawalker.com/encyclopedia-of-multimedia-technology-and-networking-2-volume-set.pdf
    • http://www.gorillawalker.com/my-first-book-of-japanese-words-bilingual-picture-dictionaries-multilingual.pdf
    • http://www.gorillawalker.com/a-survey-of-thai-arts-and-architectural-attractions-a-manual.pdf
    • http://www.gorillawalker.com/the-americans-in-the-philippines-a-history-of-the-conquest.pdf
    • http://www.gorillawalker.com/independent-travelers-2002-thailand-malaysia-and-singapore-the-budget-travel.pdf
    • http://www.gorillawalker.com/introduction-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.