Malicious PDF — malware analysis report

Static analysis result for SHA-256 37d4041afce9a4a2…

MALICIOUS

PDF

43.3 KB Created: 2018-12-03 17:45:55 +03:00 Authoring application: - (via Haru Free PDF Library 2.1.0)
MD5: 8a9dadf694b54571863602f0b7d443d9 SHA-1: 41ebec9d12ab55d48d2b320e2379959d6f18380b SHA-256: 37d4041afce9a4a24914d6952e49ceebe951c08ebeaaa0d1c2277c228c6013b9
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body is heavily obfuscated and does not provide clear textual lures. The primary attack pattern appears to be the distribution of a link farm, likely for SEO manipulation or to serve as a landing page for further malicious activity. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/east-west-encounters.pdf
    • http://www.gorillawalker.com/meteorites-a-petrologic-chemical-and-isotopic-synthesis-cambridge-planetary-science.pdf
    • http://www.gorillawalker.com/fluvial-sedimentology-vii-special-publication-35-of-the-ias-international.pdf
    • http://www.gorillawalker.com/robbins-basic-pathology.pdf
    • http://www.gorillawalker.com/the-small-business-valuation-book-easy-to-use-techniques-that.pdf
    • http://www.gorillawalker.com/ags-everyday-life-skills-surviving-on-your-own-student-workbook.pdf
    • http://www.gorillawalker.com/iron-in-aluminium-alloys-impurity-and-alloying-element-advances-in.pdf
    • http://www.gorillawalker.com/the-complete-idiot-s-guide-to-android-app-development-paperback.pdf
    • http://www.gorillawalker.com/the-natural-mind-a-new-way-of-looking-at-drugs.pdf
    • http://www.gorillawalker.com/america-s-elite-1000-the-ultimate-list.pdf
    • http://www.gorillawalker.com/eros-a-journey-of-multiple-loves.pdf
    • http://www.gorillawalker.com/bradley-a-biography-great-generals.pdf
    • http://www.gorillawalker.com/who-s-who-of-victorian-cinema-a-worldwide-survey-centenary.pdf
    • http://www.gorillawalker.com/world-travel-poster-hong-kong-9-inch-by-12-inch.pdf
    • http://www.gorillawalker.com/tools-of-the-maritime-trades.pdf
    • http://www.gorillawalker.com/soccer-rules-tips-strategy-and-safety-sports-from-coast-to.pdf
    • http://www.gorillawalker.com/digital-processing-of-signals-theory-and-practice-second-edition.pdf
    • http://www.gorillawalker.com/rock-drumming-workbook-a-guide-to-improving-your-rock-grooves.pdf
    • http://www.gorillawalker.com/deep-sea-fishing-outdoor-adventures.pdf
    • http://www.gorillawalker.com/the-wallace-dream-the-adventures-of-the-baby-seekers.pdf
    • http://www.gorillawalker.com/analog-und-digital-schriften-zur-philosophie-des-machens-german-edition.pdf
    • http://www.gorillawalker.com/eric-clapton-deluxe-piano-vocal-guitar-artist-songbook.pdf
    • http://www.gorillawalker.com/oracle-e-business-suite-inventory-r12-personal-edition.pdf
    • http://www.gorillawalker.com/snappy-little-opposites-a-big-and-small-book-of-surprises.pdf
    • http://www.gorillawalker.com/el-misterio-del-dragon-de-ojos-de-fuego-librosaurio-spanish.pdf
    • http://www.gorillawalker.com/understanding-and-treating-panic-disorder-cognitive-behavioural-approaches.pdf
    • http://www.gorillawalker.com/united-kingdom-atlas-file-keydata-collins-longman-atlases.pdf
    • http://www.gorillawalker.com/neve-french-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/reading-against-culture-ideology-and-narrative-in-the-japanese-novel.pdf
    • http://www.gorillawalker.com/the-last-lion-volume-2-winston-spencer-churchill-alone-1932.pdf
    • http://www.gorillawalker.com/the-busy-girl-s-guide-to-speed-cleaning-and-organizing.pdf
    • http://www.gorillawalker.com/blackjack-forum-fall-2000-vol-xx-3.pdf
    • http://www.gorillawalker.com/the-subluxation-specific-the-adjustment-specific-an-exposition-of-the.pdf
    • http://www.gorillawalker.com/ice-rock-and-beauty-a-visual-tour-of-the-new.pdf
    • http://www.gorillawalker.com/the-name-s-familiar-mr-leotard-barbie-and-chef-boyardee.pdf
    • http://www.gorillawalker.com/the-easter-triduum-a-ritual-pilgrimage.pdf
    • http://www.gorillawalker.com/ase-tests-at-a-glance-ase-35th-anniversary-an-article.pdf
    • http://www.gorillawalker.com/werner-hegemann-and-the-search-for-universal-urbanism.pdf
    • http://www.gorillawalker.com/la-tartine-gourmande-recipes-for-an-inspired-life-hardcover.pdf
    • http://www.gorillawalker.com/a-companion-to-philosophy-of-law-and-legal-theory-blackwell.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.