Malicious PDF — malware analysis report

Static analysis result for SHA-256 338e377233cc879e…

MALICIOUS

PDF

42.4 KB Created: 2018-12-02 10:54:45 +03:00 Authoring application: - (via Acrobat Web Capture 5.0)
MD5: fc77e7c1347039d694832273e989793f SHA-1: 6a8909442a4fab331bbcddc66023832dbbd09b68 SHA-256: 338e377233cc879e083932a0800ea47007a3fe1b4af3d1126c4e1423061b8d1e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this document as malicious. The primary attack pattern involves directing users to a link farm hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8698

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/sing-n-learn-vietnamese-book-with-audio-cd-english-and.pdf
    • http://www.gorillawalker.com/blending-to-make-it-ingredients-for-a-successful-blended-family.pdf
    • http://www.gorillawalker.com/the-caste-war-of-yucatan.pdf
    • http://www.gorillawalker.com/365-journal-writing-ideas-a-year-of-daily-journal-writing.pdf
    • http://www.gorillawalker.com/introduction-to-design-and-analysis-of-experiments.pdf
    • http://www.gorillawalker.com/holy-ghost-fire-expect-his-presence-embrace-his-move-experience.pdf
    • http://www.gorillawalker.com/decorative-cosmetics-a-formulary-of-cosmetic-preparations-v-1.pdf
    • http://www.gorillawalker.com/elementarbuch-der-sanskrit-sprache-grammatik-texte-worterbuch-de-gruyter-lehrbuch.pdf
    • http://www.gorillawalker.com/exploring-the-international-space-station-searchlight-books-what-s-amazing.pdf
    • http://www.gorillawalker.com/first-ladies-of-disco-32-stars-discuss-the-era-and.pdf
    • http://www.gorillawalker.com/la-regina-di-qualcosa-italian-edition.pdf
    • http://www.gorillawalker.com/amc-catskill-mountain-guide-amc-s-comprehensive-guide-to-hiking.pdf
    • http://www.gorillawalker.com/el-libro-completo-de-la-medicina-energ-tica-spanish-edition.pdf
    • http://www.gorillawalker.com/all-about-hanukkah-in-story-and-song-audio-cd.pdf
    • http://www.gorillawalker.com/who-speaks-for-wolf.pdf
    • http://www.gorillawalker.com/thermodynamics-and-heat-power-6th-edition.pdf
    • http://www.gorillawalker.com/knopf-mapguide-hong-kong-knopf-mapguides.pdf
    • http://www.gorillawalker.com/law-and-ethics-in-global-business-how-to-integrate-law.pdf
    • http://www.gorillawalker.com/exposure-from-snapshots-to-great-shots-2nd-edition.pdf
    • http://www.gorillawalker.com/appreciative-andragogy-taking-the-distance-out-of-distance-learning.pdf
    • http://www.gorillawalker.com/the-loss-of-el-dorado.pdf
    • http://www.gorillawalker.com/why-do-ships-float-science-in-the-real-world.pdf
    • http://www.gorillawalker.com/rosalie-bertell-scientists-eco-feminist-visionary-women-who-rock.pdf
    • http://www.gorillawalker.com/encyclopaedia-of-dance-and-ballet.pdf
    • http://www.gorillawalker.com/the-ghosts-of-varner-creek.pdf
    • http://www.gorillawalker.com/john-sinclair-folge-0823-monster-engel-2-teil-german-edition.pdf
    • http://www.gorillawalker.com/the-huddled-masses-the-immigrant-in-american-society-1880-1921.pdf
    • http://www.gorillawalker.com/self-care-for-caregivers-a-twelve-step-approach.pdf
    • http://www.gorillawalker.com/chernobyl-strawberries.pdf
    • http://www.gorillawalker.com/learn-to-play-a-stringed-instrument-violin-book-1.pdf
    • http://www.gorillawalker.com/soccer-intellect.pdf
    • http://www.gorillawalker.com/the-curious-consumerist-crusade-a-response-to-the-latest-attacks.pdf
    • http://www.gorillawalker.com/official-handbook-of-the-marvel-universe-a-to-z-volume.pdf
    • http://www.gorillawalker.com/el-gato-con-sombrero-viene-de-nuevo-the-cat-in.pdf
    • http://www.gorillawalker.com/the-social-origins-of-health-and-well-being.pdf
    • http://www.gorillawalker.com/early-history-of-the-spread-of-buddhism-the-buddhist-schools.pdf
    • http://www.gorillawalker.com/vengeance-moon-a-novel-of-the-earth-witches.pdf
    • http://www.gorillawalker.com/swan-lake-suite-op-20a-study-score.pdf
    • http://www.gorillawalker.com/the-gnostic-bible-the-pistis-sophia-unveiled.pdf
    • http://www.gorillawalker.com/tlaxcala-state.pdf
    • http://www.gorillawalker.com/elementarbuch-der-sanskrit-sprache-grammatik-texte-worterbuch-de-gruyter
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.