Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ba622cda31b7eac…

MALICIOUS

PDF

44.7 KB Created: 2018-12-14 21:24:09 +03:00 Authoring application: - (via htmldoc 1.8.23 Copyright 1997-2002 Easy Software Products, All Rights Reserved.)
MD5: 5dc8369320d724b2c77e952ec44f26ea SHA-1: 16d05fadfcb838c3f175dbe2f72cae292c18564d SHA-256: 3ba622cda31b7eacb49aaf93e83d673e2c4798ffb3a3cac85742ffbcffc7c06b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be a link farm designed to drive traffic to a large collection of documents hosted on www.gorillawalker.com, likely for SEO manipulation or to host malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/just-anger-representing-women-s-anger-in-early-modern-england.pdf
    • http://www.gorillawalker.com/engineering-design-via-surrogate-modelling-a-practical-guide-progress-in.pdf
    • http://www.gorillawalker.com/ruby-who-the-workbook-for-kids.pdf
    • http://www.gorillawalker.com/child-support-practitioner-s-guide-vol-2-practitioner-series.pdf
    • http://www.gorillawalker.com/veiled-security-kindle-edition.pdf
    • http://www.gorillawalker.com/library-media-center-problems-case-studies.pdf
    • http://www.gorillawalker.com/sammy-child-survivor-of-the-holocaust-teachers-guide-and-workbook.pdf
    • http://www.gorillawalker.com/chakras-for-beginners-an-amazing-7-step-guide-for-absolute.pdf
    • http://www.gorillawalker.com/manual-de-porcicultura-pig-farming-manual-una-guia-paso-a.pdf
    • http://www.gorillawalker.com/learning-the-city-knowledge-and-translocal-assemblage.pdf
    • http://www.gorillawalker.com/family-planning-a-comedy.pdf
    • http://www.gorillawalker.com/food-labelling-data-for-manufacturers.pdf
    • http://www.gorillawalker.com/total-lockdown-kindle-edition.pdf
    • http://www.gorillawalker.com/daily-reading-comprenesion-grade-1-daily-reading-comprehension.pdf
    • http://www.gorillawalker.com/presidents-of-st-john-association-of-saint-lucia-profile-book.pdf
    • http://www.gorillawalker.com/lymphedema-understanding-and-managing-lymphedema-after-cancer-treatment.pdf
    • http://www.gorillawalker.com/wealth-for-life-the-formula-to-achieving-wealth-and-financial.pdf
    • http://www.gorillawalker.com/warcraft-the-roleplaying-game.pdf
    • http://www.gorillawalker.com/encyclopaedia-arcane-components-and-foci.pdf
    • http://www.gorillawalker.com/bioremediation-of-wastewater-factors-and-treatment.pdf
    • http://www.gorillawalker.com/early-architecture-of-the-town-township-of-niagara-introductions-by.pdf
    • http://www.gorillawalker.com/three-days-in-august-a-u-s-army-special-forces.pdf
    • http://www.gorillawalker.com/german-pioneers-of-montgomery-county-ohio-early-pioneer-life-in.pdf
    • http://www.gorillawalker.com/emerald-prince-kindle-edition.pdf
    • http://www.gorillawalker.com/john-wilson-to-william-wordsworth-1802-a-new-text-critical.pdf
    • http://www.gorillawalker.com/mel-bay-presents-art-of-tremolo.pdf
    • http://www.gorillawalker.com/a-reader-in-animation-studies.pdf
    • http://www.gorillawalker.com/life-history-and-biogeography-patterns-in-conus-oxford-biogeography-series.pdf
    • http://www.gorillawalker.com/man-a-machine-and-man-a-plant.pdf
    • http://www.gorillawalker.com/how-to-estimate-building-losses-and-construction-costs.pdf
    • http://www.gorillawalker.com/eyewitness-travel-planner-california.pdf
    • http://www.gorillawalker.com/hobbyist-electroplating-made-easy-electroplating-fundamentals-on-dvd-w-book.pdf
    • http://www.gorillawalker.com/lucinda-devlin-the-omega-suites.pdf
    • http://www.gorillawalker.com/shackleton-irishman-in-antarctica.pdf
    • http://www.gorillawalker.com/lonely-planet-baltic-phrasebook-dictionary-lonely-planet-phrasebook-baltic.pdf
    • http://www.gorillawalker.com/the-vietnam-war-an-assessment-by-south-vietnam-s-generals.pdf
    • http://www.gorillawalker.com/network-performance-toolkit-using-open-source-testing-tools.pdf
    • http://www.gorillawalker.com/richard-chamberlain-an-actor-s-life.pdf
    • http://www.gorillawalker.com/communication-planning-an-integrated-approach-sage-series-in-public-relations.pdf
    • http://www.gorillawalker.com/dbs-a-patient-guide-to-deep-brain-stimulation.pdf
    • http://www.gorillawalker.com/manual-de-porcicultura-p
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.