Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a7f3d98c21c97ca…

MALICIOUS

PDF

42.0 KB Created: 2019-02-14 08:08:53 +03:00 Authoring application: QuarkXPress¢â: LaserWriter 8 KH-8.7.1 (via Acrobat Distiller 4.05 for Macintosh)
MD5: 87f8b889a4205ba356dbdbb686a295e1 SHA-1: 8a16fc5f9c49ea7dd2fbfdc025d9fbdc95735325 SHA-256: 3a7f3d98c21c97ca0dc5296bc25b1b0a8b9b125143529b2dc54283ac1ce41afa
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a heuristic firing for PDF_SEO_LINK_FARM, indicating a large number of external links. The document body, though heavily obfuscated, contains numerous URLs pointing to PDF files hosted on www.gorillawalker.com. This suggests a link farm or redirection tactic to a large collection of documents, likely for SEO manipulation or to host malicious content.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/managing-12-volts-how-to-upgrade-operate-and-troubleshoot-12.pdf
    • http://www.gorillawalker.com/abhb-annual-bibliography-of-the-history-of-the-printed-book.pdf
    • http://www.gorillawalker.com/my-favorite-world-tour-travels-in-indonesia-chinese-edition.pdf
    • http://www.gorillawalker.com/arab-human-development-report-2003-building-a-knowledge-society.pdf
    • http://www.gorillawalker.com/kampung-boy.pdf
    • http://www.gorillawalker.com/mcdougal-littell-middle-school-math-california-notetaking-guide-student-algebra.pdf
    • http://www.gorillawalker.com/hal-leonard-the-ultimate-jazz-fake-book-for-piano-guitar.pdf
    • http://www.gorillawalker.com/soldier-five-the-real-truth-about-the-bravo-two-zero.pdf
    • http://www.gorillawalker.com/abridged-history-of-the-eighth-indiana-volunteer-infantry-from-its.pdf
    • http://www.gorillawalker.com/holt-science-and-technology-forces-motion-and-energy-short-course.pdf
    • http://www.gorillawalker.com/medical-scribe-training-manual-for-the-physician-practice.pdf
    • http://www.gorillawalker.com/body-shots-i-heart-that-city.pdf
    • http://www.gorillawalker.com/blessed-one-protestant-perspectives-on-mary.pdf
    • http://www.gorillawalker.com/down-low-double-life.pdf
    • http://www.gorillawalker.com/pakistan-s-political-labyrinths-military-society-and-terror.pdf
    • http://www.gorillawalker.com/puzzle-gallery-pets.pdf
    • http://www.gorillawalker.com/the-kite-runner-bloom-s-guides.pdf
    • http://www.gorillawalker.com/histoire-naturelle-g-n-rale-et-th-orie-du-ciel.pdf
    • http://www.gorillawalker.com/the-muscle-and-bone-palpation-manual-with-trigger-points-referral.pdf
    • http://www.gorillawalker.com/mandarin-b-for-the-ib-diploma.pdf
    • http://www.gorillawalker.com/viva-travel-guides-galapagos-islands.pdf
    • http://www.gorillawalker.com/field-manual-fm-6-0-commander-and-staff-organization-and.pdf
    • http://www.gorillawalker.com/the-manufacture-of-chemicals-by-batch-or-continuous-processing-how.pdf
    • http://www.gorillawalker.com/seals-and-sea-lions-monterey-bay-aquarium-natural-history-series.pdf
    • http://www.gorillawalker.com/handbook-of-physical-medicine-and-rehabilitation-basics-lippincott-williams-wilkins.pdf
    • http://www.gorillawalker.com/new-essays-on-leibniz-s-theodicy.pdf
    • http://www.gorillawalker.com/coin-collecting-for-fun-profit-the-fast-and-fun-way.pdf
    • http://www.gorillawalker.com/dragon-s-time-the-dragon-books.pdf
    • http://www.gorillawalker.com/just-fuck-me-what-women-want-men-to-know-about.pdf
    • http://www.gorillawalker.com/the-ninth-generation-conquering-the-giants-kindle-edition.pdf
    • http://www.gorillawalker.com/the-national-mark-calendar-of-cooking-compiled-for-the-ministry.pdf
    • http://www.gorillawalker.com/diagnostic-testing-and-functional-medicine.pdf
    • http://www.gorillawalker.com/the-quiet-place.pdf
    • http://www.gorillawalker.com/selected-commercial-statutes-for-payment-systems-courses-2013-selected-statutes.pdf
    • http://www.gorillawalker.com/the-berenstain-bears-giant-coloring-and-activity-book-dover-coloring.pdf
    • http://www.gorillawalker.com/dutch-tiles-in-the-philadelphia-museum-of-art.pdf
    • http://www.gorillawalker.com/the-first-step-how-to-play-the-ukulele-and-ukulele.pdf
    • http://www.gorillawalker.com/who-s-in-charge-here-the-complex-relationship-between-ministry.pdf
    • http://www.gorillawalker.com/renewable-energy-fourth-edition-physics-engineering-environmental-impacts-economics-planning.pdf
    • http://www.gorillawalker.com/journalism-in-the-movies-history-of-communication.pdf
    • http://www.gorillawalker.com/hal-leonard-the-ultimate-jazz-fake-book-for-piano-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.