Malicious PDF — malware analysis report

Static analysis result for SHA-256 42526f096e6d1932…

MALICIOUS

PDF

42.3 KB Created: 2018-11-30 20:56:52 +03:00 Authoring application: FPDF 1.53
MD5: 1923ed3b7577db779289753147411e0c SHA-1: 9d1e9f2c34bc6c1c4b0d9f109abf1a4ad9715c74 SHA-256: 42526f096e6d19329577ed1e19f32e0121ac4b9acf82cf40a303debb4a0695b5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF documents on the domain www.gorillawalker.com. This suggests a tactic to manipulate search engine results or to distribute a large volume of content, potentially malicious. The ML classifier also flagged the document as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/brand-new-ancients.pdf
    • http://www.gorillawalker.com/book-of-mormon-book-of-lies.pdf
    • http://www.gorillawalker.com/the-secret-voyage-of-sir-francis-drake-1577-1580.pdf
    • http://www.gorillawalker.com/principles-of-risk-management-and-insurance-12th-edition-pearson-series.pdf
    • http://www.gorillawalker.com/how-you-can-fight-human-trafficking-over-50-ways-to.pdf
    • http://www.gorillawalker.com/mcdougal-littell-passports-student-edition-algebra-and-geometry-2004.pdf
    • http://www.gorillawalker.com/genetics-genomics-and-breeding-of-forage-crops-genetics-genomics-and.pdf
    • http://www.gorillawalker.com/ethan-exposed-further-adventures-from-ethan-green-s-unfabulous-social.pdf
    • http://www.gorillawalker.com/drug-interaction-facts-2015.pdf
    • http://www.gorillawalker.com/the-semeia-in-the-fourth-gospel-tradition-and-redaction-novum.pdf
    • http://www.gorillawalker.com/un-jardin-mas-alla-del-paraiso-poemas-de-amor-de.pdf
    • http://www.gorillawalker.com/sigh-no-more-ladies-vocal-score.pdf
    • http://www.gorillawalker.com/low-frequency-astrophysics-from-space-proceedings-of-an-international-workshop.pdf
    • http://www.gorillawalker.com/adc-stafford-county-va-street-atlas.pdf
    • http://www.gorillawalker.com/blood-on-the-altar-the-coming-war-between-christian-vs.pdf
    • http://www.gorillawalker.com/communication-and-communication-disorders-a-clinical-introduction-4th-edition-allyn.pdf
    • http://www.gorillawalker.com/life-of-william-cowper.pdf
    • http://www.gorillawalker.com/josephus-interpretation-of-the-books-of-samuel-the-library-of.pdf
    • http://www.gorillawalker.com/the-best-test-preparation-for-the-gre-graduate-record-examination.pdf
    • http://www.gorillawalker.com/pmp-exam-practice-test-and-study-guide-fifth-edition.pdf
    • http://www.gorillawalker.com/the-official-price-guide-to-dolls.pdf
    • http://www.gorillawalker.com/rallenti-the-battaglia-mafia-series-kindle-edition.pdf
    • http://www.gorillawalker.com/zulu-with-some-guts-behind-it-the-making-of-the.pdf
    • http://www.gorillawalker.com/the-endlands-vol-1.pdf
    • http://www.gorillawalker.com/topics-in-operator-theory-volume-1-operators-matrices-and-analytic.pdf
    • http://www.gorillawalker.com/london-handstyles.pdf
    • http://www.gorillawalker.com/free-ranging-dogs-and-wildlife-conservation.pdf
    • http://www.gorillawalker.com/in-bed-with-david-jonathan.pdf
    • http://www.gorillawalker.com/money-power-a-billionaire-boxed-set-the-naughty-list-special.pdf
    • http://www.gorillawalker.com/the-last-empire-de-beers-diamonds-and-the-world.pdf
    • http://www.gorillawalker.com/the-human-division-old-man-s-war-book-5-kindle.pdf
    • http://www.gorillawalker.com/architectural-digest-10-94-fashion-designer-issue.pdf
    • http://www.gorillawalker.com/the-everything-u-s-constitution-book-an-easy-to-understand.pdf
    • http://www.gorillawalker.com/out-of-step-a-life-in-ballet.pdf
    • http://www.gorillawalker.com/christ-the-king-lord-of-history-a-catholic-world-history.pdf
    • http://www.gorillawalker.com/teachers-rule-mad-libs.pdf
    • http://www.gorillawalker.com/soccer-tactical-periodization-made-simple-a-soccer-coaching-model-kindle.pdf
    • http://www.gorillawalker.com/7-7-the-london-bombings-islam-and-the-iraq-war.pdf
    • http://www.gorillawalker.com/the-magic-school-bus-in-the-time-of-the-dinosaurs.pdf
    • http://www.gorillawalker.com/consider-the-birds.pdf
    • http://www.gorillawalker.com/how-you-can-fight-human-traf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.