Malicious PDF — malware analysis report

Static analysis result for SHA-256 3eb3d1f3409597b4…

MALICIOUS

PDF

44.6 KB Created: 2018-11-26 21:48:58 +03:00 Authoring application: Data Dynamics ActiveReports (tm) for .NET
MD5: 46b4e2688991f8d6e3442d98afe14b17 SHA-1: 47be8885b6e221a4f971d0f289fb57a966cb89ad SHA-256: 3eb3d1f3409597b4b03961a359338f350a9f43309b2df69bc1a32f078be85b3b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a critical heuristic for containing a mass external PDF link farm, with 32 links pointing to various documents on gorillawalker.com. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the structure and content suggest a social engineering tactic to lure users to download further content, potentially leading to malicious payloads or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8224

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/gorbachev-yeltsin-and-putin-political-leadership-in-russia-s-transition.pdf
    • http://www.gorillawalker.com/geheimakte-mars-04-rebellion-auf-proxima-centauri-volume-4-german.pdf
    • http://www.gorillawalker.com/black-tide-rising-a-dan-connor-mystery-kindle-edition.pdf
    • http://www.gorillawalker.com/increasing-children-s-physical-activity-an-article-from-joperd-the.pdf
    • http://www.gorillawalker.com/more-and-more-spring-flowers-and-me-flower-series-book.pdf
    • http://www.gorillawalker.com/abnormal-pressures-while-drilling-manuels-techniques.pdf
    • http://www.gorillawalker.com/mozart-s-symphonies-context-performance-practice-reception-clarendon-paperbacks.pdf
    • http://www.gorillawalker.com/essays-and-aphorisms-penguin-classics.pdf
    • http://www.gorillawalker.com/assessment-of-tree-health-along-trevor-road-new-forest-area.pdf
    • http://www.gorillawalker.com/spare-parts-and-dismemberment.pdf
    • http://www.gorillawalker.com/the-official-lsat-preptest-40.pdf
    • http://www.gorillawalker.com/urban-nightlife-entertaining-race-class-and-culture-in-public-space.pdf
    • http://www.gorillawalker.com/nero-wolfe-eeny-meeny-murder-mo.pdf
    • http://www.gorillawalker.com/sweeney-todd-the-graphic-novel-quick-text-british-english.pdf
    • http://www.gorillawalker.com/illustrated-walks-in-london-regent.pdf
    • http://www.gorillawalker.com/john-lennon-a-celebration-of-his-life-and-legacy.pdf
    • http://www.gorillawalker.com/the-french-renaissance-court.pdf
    • http://www.gorillawalker.com/rape-hate-sex-violence-in-war-peace.pdf
    • http://www.gorillawalker.com/find-out-who-s-normal-and-who-s-not-the.pdf
    • http://www.gorillawalker.com/drawing-the-human-head-1976-cloth.pdf
    • http://www.gorillawalker.com/two-hundred-flash-tips.pdf
    • http://www.gorillawalker.com/a-thread-unbroken.pdf
    • http://www.gorillawalker.com/an-inspector-calls-york-notes-for-gcse-workbook-grades-9.pdf
    • http://www.gorillawalker.com/manual-of-orthopaedics.pdf
    • http://www.gorillawalker.com/characterization-in-silicon-processing-materials-characterization.pdf
    • http://www.gorillawalker.com/the-penn-state-report-a-summary-of-the-freeh-investigation.pdf
    • http://www.gorillawalker.com/the-britannica-guide-to-explorers-and-explorations-that-changed-the.pdf
    • http://www.gorillawalker.com/encyclopedia-of-u-s-military-aircraft-part-i-1908-to.pdf
    • http://www.gorillawalker.com/principles-of-poetry-shi-no-genri-cornell-east-asia-no.pdf
    • http://www.gorillawalker.com/turkish-cologne-the-mental-maps-of-migrant-workers-in-a.pdf
    • http://www.gorillawalker.com/grounded-in-god-care-and-nurture-in-friends-meetings.pdf
    • http://www.gorillawalker.com/walking-on-eggshells-living-with-psychological-abuse-and-codependency.pdf
    • http://www.gorillawalker.com/making-money-social-studies.pdf
    • http://www.gorillawalker.com/sarah-s-seduction-men-of-august-book-2.pdf
    • http://www.gorillawalker.com/understanding-qualitative-research-and-ethnomethodology.pdf
    • http://www.gorillawalker.com/something-in-the-car-the-literacy-tower.pdf
    • http://www.gorillawalker.com/who-is-mary-three-early-modern-women-on-the-idea.pdf
    • http://www.gorillawalker.com/sister-sarah-s-pick-5-straight-shooter-s-system-win.pdf
    • http://www.gorillawalker.com/supporting-internationalisation-through-languages-and-culture-in-the-twenty-first.pdf
    • http://www.gorillawalker.com/evapotranspiration-principles-and-applications-for-water-management.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.