Malicious PDF — malware analysis report

Static analysis result for SHA-256 37ba0be149ac6146…

MALICIOUS

PDF

42.7 KB Created: 2019-01-06 08:14:46 +03:00 Authoring application: - (via PDFlib Personalization Server 5.0.1 (COM/Win32) unlicensed)
MD5: 168e3e68b340ed26c8e23b9cfcdd2e37 SHA-1: f19b999afec53a226a8d60413c9cdc140482d24f SHA-256: 37ba0be149ac61464ffbf1aa9ba053730afa570ead194c8cf4895778cab6aab2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or SEO spam tactic. The ML classifier also indicated a high probability of maliciousness. The embedded URLs point to various documents on the same domain, likely serving as lures or redirects. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/wind-farms-at-issue.pdf
    • http://www.gorillawalker.com/shanghai-urban-road-traffic-map-2008-mass-transit-transfer-guide.pdf
    • http://www.gorillawalker.com/data-access-for-highly-scalable-solutions-using-sql-nosql-and.pdf
    • http://www.gorillawalker.com/becoming-heidegger-on-the-trail-of-his-early-occasional-writings.pdf
    • http://www.gorillawalker.com/identity-and-art-therapy-personal-and-professional-perspectives.pdf
    • http://www.gorillawalker.com/take-great-photos-find-your-talent.pdf
    • http://www.gorillawalker.com/planet-radio-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/my-soul-is-a-woman-the-feminine-in-islam.pdf
    • http://www.gorillawalker.com/success-behaviors-of-highly-talented-managers-what-great-managers-actually.pdf
    • http://www.gorillawalker.com/the-tragedy-of-othello-the-moor-of-venice-new-kittredge.pdf
    • http://www.gorillawalker.com/dogs-delight-if-you-think-country-folk-are-strange-think.pdf
    • http://www.gorillawalker.com/at-the-farm-field-trips-child-s-world.pdf
    • http://www.gorillawalker.com/maisy-goes-to-the-library-a-maisy-first-experience-book.pdf
    • http://www.gorillawalker.com/communication-cinema-development-from-morosity-to-hope.pdf
    • http://www.gorillawalker.com/forgotten-saved-loved-the-prologue-a-werewolf-story.pdf
    • http://www.gorillawalker.com/wine-by-wine-tasting-and-appreciation-paperback.pdf
    • http://www.gorillawalker.com/language-discourse-and-translation-in-the-west-and-middle-east.pdf
    • http://www.gorillawalker.com/sentence-siberia-a-story-of-survival.pdf
    • http://www.gorillawalker.com/astrological-practice-of-physick.pdf
    • http://www.gorillawalker.com/i-vostri-padri-dove-sono-e-i-profeti-vivono-forse.pdf
    • http://www.gorillawalker.com/the-anchor-bible-dictionary-o-sh-volume-5.pdf
    • http://www.gorillawalker.com/social-development-theory-and-practice.pdf
    • http://www.gorillawalker.com/custom-broken-for-good-the-controversial-trust-spanish-edition.pdf
    • http://www.gorillawalker.com/cocaine-turtleback-school-library-binding-edition-watts-library.pdf
    • http://www.gorillawalker.com/olvera-street-tm-discover-the-soul-of-los-angeles-mike.pdf
    • http://www.gorillawalker.com/the-bible-in-90-days-an-extraordinary-experience-with-the.pdf
    • http://www.gorillawalker.com/ecclesiastes-the-philippians-of-the-old-testament-focus-on-the.pdf
    • http://www.gorillawalker.com/waiting-and-dating-a-sensible-guide-to-a-fulfilling-love.pdf
    • http://www.gorillawalker.com/talisman-gnostics-freemasons-revolutionaries-and-the-2000-year-old-conspiracy.pdf
    • http://www.gorillawalker.com/pmp-exam-prep-2015-edition.pdf
    • http://www.gorillawalker.com/light-matters.pdf
    • http://www.gorillawalker.com/satanic-summer.pdf
    • http://www.gorillawalker.com/ghost-legion.pdf
    • http://www.gorillawalker.com/barron-s-practice-exercises-for-the-toefl-4-cd-set.pdf
    • http://www.gorillawalker.com/the-philosophical-principles-of-integral-knowledge.pdf
    • http://www.gorillawalker.com/supply-chain-network-economics-dynamics-of-prices-flows-and-profits.pdf
    • http://www.gorillawalker.com/how-to-bonk-at-work.pdf
    • http://www.gorillawalker.com/the-nutcracker-and-the-mouse-king-a-bbc-radio-4.pdf
    • http://www.gorillawalker.com/guide-to-night-singing-insects-of-the-northeast.pdf
    • http://www.gorillawalker.com/going-for-the-gold-how-the-u-s-olympic-hockey.pdf
    • http://www.gorillawalker.com
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.