Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a8efc167d306fb2…

MALICIOUS

PDF

42.5 KB Created: 2018-12-14 20:00:59 +03:00 Authoring application: Adobe InDesign CC 2014 (Macintosh) (via Adobe PDF Library 11.0)
MD5: 020b09713ed8bf8ea149ded95f002ba0 SHA-1: e2913a9a7a8e4812b66a1660a4a5e3e6edaa0e43 SHA-256: 3a8efc167d306fb242a590a05ac853a0ff9b1342136f9fc4b54650a54be6a4ec
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The primary purpose appears to be SEO manipulation or distributing links to potentially malicious content hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/le-cid-focus-student-edition-french-edition.pdf
    • http://www.gorillawalker.com/berlitz-cairo-pocket-guide-berlitz-pocket-guides.pdf
    • http://www.gorillawalker.com/handbook-of-gastrointestinal-and-genitourinary-radiology-handbooks-in-radiology-series.pdf
    • http://www.gorillawalker.com/corrosion-and-conservation-of-cultural-heritage-metallic-artefacts-european-federation.pdf
    • http://www.gorillawalker.com/seduced-seduced-3-sexy-erotica-photo-erotic-photography-sexy-erotic.pdf
    • http://www.gorillawalker.com/la-prometida-del-pie-grande-el-secuestro-libro-1-er.pdf
    • http://www.gorillawalker.com/new-testament-bible-stories-for-children.pdf
    • http://www.gorillawalker.com/the-headscarf-debates-conflicts-of-national-belonging.pdf
    • http://www.gorillawalker.com/handspinner-s-handbook.pdf
    • http://www.gorillawalker.com/vinagre-de-sidra-de-manzana-milagroso-sistema-de-salud-spanish.pdf
    • http://www.gorillawalker.com/busy-chickens-a-busy-book-kindle-edition.pdf
    • http://www.gorillawalker.com/22-virtuosity-studies-for-trumpet.pdf
    • http://www.gorillawalker.com/anyone-can-be-an-expert-skier-2-kindle-edition.pdf
    • http://www.gorillawalker.com/memory-and-complicity-migrations-of-holocaust-remembrance.pdf
    • http://www.gorillawalker.com/job-market-futurity-planning-and-managing-local-manpower-programs.pdf
    • http://www.gorillawalker.com/mounted-pregnant-by-unicorn-kindle-edition.pdf
    • http://www.gorillawalker.com/condition-the-ageing-of-art.pdf
    • http://www.gorillawalker.com/beauties-of-ancient-english-and-scottish-history-to-which-is.pdf
    • http://www.gorillawalker.com/2013-calendar-susan-winget-cottage-garden-2013-wall-calendar.pdf
    • http://www.gorillawalker.com/skin-care-course-chinese-edition.pdf
    • http://www.gorillawalker.com/america-s-important-neighbors-canada-mexico-and-cuba-the-here.pdf
    • http://www.gorillawalker.com/die-letzte-zeugin-thriller-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/i-love-sweet-treats-activity-book-a-yummy-assortment-of.pdf
    • http://www.gorillawalker.com/berlitz-turkish-phrase-book-dictionary.pdf
    • http://www.gorillawalker.com/act-strategy-smart-book-online-sat-psat-act-college-admission.pdf
    • http://www.gorillawalker.com/the-summer-of-good-intentions-a-novel.pdf
    • http://www.gorillawalker.com/decision-making-descriptive-normative-and-prescriptive-interactions.pdf
    • http://www.gorillawalker.com/sunbeam-house-bray.pdf
    • http://www.gorillawalker.com/managing-for-quality-and-performance-excellence-with-cd-rom.pdf
    • http://www.gorillawalker.com/ellis-island-to-ebbets-field-sport-and-the-american-jewish.pdf
    • http://www.gorillawalker.com/handbook-of-paleolithic-typology-lower-and-middle-paleolithic-of-europe.pdf
    • http://www.gorillawalker.com/poetics-of-cinema.pdf
    • http://www.gorillawalker.com/flaked-out-the-story-of-cod-and-newfoundland-kindle-edition.pdf
    • http://www.gorillawalker.com/heavy-metal-vol-18-no-3.pdf
    • http://www.gorillawalker.com/decouverte-de-corinthiens-french-discovering-corinthians-french-edition.pdf
    • http://www.gorillawalker.com/a-concise-lexicon-of-late-biblical-hebrew-linguistic-innovations-in.pdf
    • http://www.gorillawalker.com/beyond-ceilings.pdf
    • http://www.gorillawalker.com/turok-son-of-stone-archives-volume-1.pdf
    • http://www.gorillawalker.com/cessna-172-a-pocket-history-by-ron-smith-published-by.pdf
    • http://www.gorillawalker.com/high-altitude-platforms-for-wireless-communications.pdf
    • http://www.gorillawalke
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.