Malicious PDF — malware analysis report

Static analysis result for SHA-256 4011e20f7bad534c…

MALICIOUS

PDF

43.8 KB Created: 2019-03-17 06:14:19 +03:00 Authoring application: Adobe Acrobat 7.05 (via Adobe Acrobat 7.05 Paper Capture Plug-in)
MD5: a1dd478ea03370ef06b643861b1964c6 SHA-1: 954ed7038c348f846f29f1ed70063d5da61fb1a6 SHA-256: 4011e20f7bad534cadbcbf5ce73d0ec126f3fccda833b51a99e2193c4d2c15fc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm, directing users to numerous PDF files hosted on www.gorillawalker.com, likely for malicious SEO or to distribute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/heavy-metal-a-tank-company-s-battle-to-baghdad.pdf
    • http://www.gorillawalker.com/national-geographic-december-1978-vol-154-no-6.pdf
    • http://www.gorillawalker.com/radiologia-del-torax-atlas-de-aprendizaje-sistematico-spanish-edition.pdf
    • http://www.gorillawalker.com/mining-international-year-book-1979.pdf
    • http://www.gorillawalker.com/the-eye-of-the-tiger-hungry-as-the-sea-thomas.pdf
    • http://www.gorillawalker.com/las-cien-mejores-anecdotas-de-la-ii-guerra-mundial-spanish.pdf
    • http://www.gorillawalker.com/love-hickory-a-southern-lady-prevails-at-99-part-one.pdf
    • http://www.gorillawalker.com/new-season-a-novel-kindle-edition.pdf
    • http://www.gorillawalker.com/dangerous-pasts-c-m-security-book-5.pdf
    • http://www.gorillawalker.com/20-questions-and-answers-about-shift-work-disorder.pdf
    • http://www.gorillawalker.com/rethinking-american-electoral-democracy-controversies-in-electoral-democracy-and-representation.pdf
    • http://www.gorillawalker.com/cerdos-a-montones-cerdos-a-granel-spanish-edition.pdf
    • http://www.gorillawalker.com/the-history-of-first-baptist-church-blytheville-arkansas.pdf
    • http://www.gorillawalker.com/citizenship-passing-the-test-teacher-s-guide.pdf
    • http://www.gorillawalker.com/a-pilgrimage-to-kashi-banaras-varanasi-kashi-history-mythology-and.pdf
    • http://www.gorillawalker.com/101-techniques-oil.pdf
    • http://www.gorillawalker.com/winfield-house.pdf
    • http://www.gorillawalker.com/information-networking-international-conference-icoin-2002-cheju-island-korea-january.pdf
    • http://www.gorillawalker.com/the-princess-and-the-frog-learn-to-draw-disney-princess.pdf
    • http://www.gorillawalker.com/exercices-de-grammaire-a1-du-cadre-europeen-french-edition.pdf
    • http://www.gorillawalker.com/a-gravity-s-rainbow-companion-sources-and-contexts-for-pynchon.pdf
    • http://www.gorillawalker.com/nicholas-ray-an-american-journey.pdf
    • http://www.gorillawalker.com/every-landlord-s-legal-guide-paperback.pdf
    • http://www.gorillawalker.com/orlando-furioso-di-ludovico-ariosto-grandi-classici-italian-edition.pdf
    • http://www.gorillawalker.com/the-path-to-the-double-helix-the-discovery-of-dna.pdf
    • http://www.gorillawalker.com/requiem-for-soprano-and-baritone-soli-chorus-vocal-score-only.pdf
    • http://www.gorillawalker.com/sciatica-an-entry-from-thomson-gale-s-gale-encyclopedia-of.pdf
    • http://www.gorillawalker.com/captured-by-vikings-an-mmf-bisexual-threesome.pdf
    • http://www.gorillawalker.com/doctrine-et-politia-ecclesiae-anglicanae-an-anglican-summan-studies-in.pdf
    • http://www.gorillawalker.com/insect-media-an-archaeology-of-animals-and-technology-posthumanities.pdf
    • http://www.gorillawalker.com/residues-and-duality-lecture-notes-of-a-seminar-on-the.pdf
    • http://www.gorillawalker.com/the-normal-bar-the-surprising-secrets-of-happy-couples-and.pdf
    • http://www.gorillawalker.com/tapp-steps-in-time-management.pdf
    • http://www.gorillawalker.com/the-arabs-of-the-ottoman-empire-1516-1918-a-social.pdf
    • http://www.gorillawalker.com/arthur-s-halloween-an-arthur-adventure.pdf
    • http://www.gorillawalker.com/poetry-for-celestial-nymphs-and-wayward-witches.pdf
    • http://www.gorillawalker.com/breakfast-at-the-birdfeeder.pdf
    • http://www.gorillawalker.com/seal-hunting-newfoundland-and-labrador-canada-1965-1966-photo-albums.pdf
    • http://www.gorillawalker.com/el-corredor-de-fondo-spanish-edition.pdf
    • http://www.gorillawalker.com/visits-to-the-blessed-sacrament-with-supplemental-reading-novena-of.pdf
    • http://www.gorillawalker.com/the-eye-of-the-tiger-h
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.