Malicious PDF — malware analysis report

Static analysis result for SHA-256 31fdd24e3a0ac63e…

MALICIOUS

PDF

36.0 KB Created: 2020-02-07 20:59:45 +03:00 Authoring application: Adobe InDesign CS5_J (7.0.4) (via Acrobat Distiller 9.5.0 (Windows))
MD5: e8b69693ffa7bad6efe9337602b9d7b0 SHA-1: deee447652218921430a8a150c99debb49433891 SHA-256: 31fdd24e3a0ac63e6721144e5fe8b2250566e9fec3bec3497830aad63b09d8dd
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a vast collection of documents hosted on www.gorillawalker.com, which is likely an attempt to manipulate search engine rankings or distribute additional malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7977

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/shards-garth-clark-on-ceramic-art.pdf
    • http://www.gorillawalker.com/viola-time-scales-pieces-puzzles-scales-and-arpeggios.pdf
    • http://www.gorillawalker.com/instantly-how-quickly-i-realized-i-hate-my-job.pdf
    • http://www.gorillawalker.com/cambridge-igcse-and-o-level-economics-workbook.pdf
    • http://www.gorillawalker.com/law-dictionary-deutsch-englisch-german-english-law-dictionary-technical-dictionary.pdf
    • http://www.gorillawalker.com/einf-hrung-in-die-regelungstechnik-lineare-und-nichtlineare-regelvorg-nge.pdf
    • http://www.gorillawalker.com/spot-test-analysis-clinical-environmental-forensic-and-geochemical-applications.pdf
    • http://www.gorillawalker.com/microsoft-asp-net-2-0-step-by-step-step-by.pdf
    • http://www.gorillawalker.com/understanding-american-power-the-changing-world-of-us-foreign-policy.pdf
    • http://www.gorillawalker.com/the-anti-romantic-hegel-against-ironic-romanticism.pdf
    • http://www.gorillawalker.com/bengali-harlem-and-the-lost-histories-of-south-asian-america.pdf
    • http://www.gorillawalker.com/blue-of-noon-penguin-modern-classics-kindle-edition.pdf
    • http://www.gorillawalker.com/ultracold-gases-and-quantum-information-lecture-notes-of-the-les.pdf
    • http://www.gorillawalker.com/friendly-skies.pdf
    • http://www.gorillawalker.com/malcolm-x-biography-lerner-hardcover.pdf
    • http://www.gorillawalker.com/rodd-s-chemistry-of-carbon-compounds-volume-2-alicyclic-compounds.pdf
    • http://www.gorillawalker.com/the-alps.pdf
    • http://www.gorillawalker.com/aristotle-the-philosopher.pdf
    • http://www.gorillawalker.com/2014-america-s-top-restaurants-leather-zagat-survey-america-s.pdf
    • http://www.gorillawalker.com/hello-kitty-crochet-supercute-amigurumi-patterns-for-sanrio-friends-kindle.pdf
    • http://www.gorillawalker.com/cancer-sucks-but-who-asked-you.pdf
    • http://www.gorillawalker.com/year-4-vocabulary-grammar-and-punctuation-pupil-book-treasure-house.pdf
    • http://www.gorillawalker.com/unique-media-map-canada-with-ottawa-folded.pdf
    • http://www.gorillawalker.com/artificial-cognitive-systems-a-primer.pdf
    • http://www.gorillawalker.com/the-memoir-project-a-thoroughly-non-standardized-text-for-writing.pdf
    • http://www.gorillawalker.com/you-re-hired-making-the-best-of-job-interviews.pdf
    • http://www.gorillawalker.com/abusir-xiv-faience-inlays-from-the-funerary-temple-of-king.pdf
    • http://www.gorillawalker.com/the-origin-of-chronic-inflammatory-systemic-diseases-and-their-sequelae.pdf
    • http://www.gorillawalker.com/the-path-to-purpose-how-young-people-find-their-calling.pdf
    • http://www.gorillawalker.com/taiwan-in-the-global-economy-from-an-agrarian-economy-to.pdf
    • http://www.gorillawalker.com/slave-rebellion-in-brazil-the-muslim-uprising-of-1835-in.pdf
    • http://www.gorillawalker.com/electroterapia-termoterapia-e-hidroterapia-spanish-edition.pdf
    • http://www.gorillawalker.com/the-chemistry-of-organomagnesium-compounds-patai-s-chemistry-of-functional.pdf
    • http://www.gorillawalker.com/bobbing-drake-volume-1.pdf
    • http://www.gorillawalker.com/piccolomini-en-iberia-influencias-italianas-en-el-g-nesis-de.pdf
    • http://www.gorillawalker.com/mayan-gods.pdf
    • http://www.gorillawalker.com/medical-staff-services-handbook-fundamentals-beyond.pdf
    • http://www.gorillawalker.com/a-vis-o-de-joaquina-cole-o-meimei-portuguese-edition.pdf
    • http://www.gorillawalker.com/an-introduction-to-stochastic-modeling-third-edition.pdf
    • http://www.gorillawalker.com/cascades-calendar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.