Malicious PDF — malware analysis report

Static analysis result for SHA-256 43b95ca9cf9b5b51…

MALICIOUS

PDF

44.4 KB Created: 2018-11-30 20:30:17 +03:00 Authoring application: - (via ABBYY FineReader 9.0 Sprint)
MD5: 5015d29ca3f471dc02e981b72e0976ae SHA-1: 3ffd86b3cbfbf054172c10143ddc06374938d072 SHA-256: 43b95ca9cf9b5b5123a693b6d0f5e0d321ce674da36aaf76c4e2b200b062ea8c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a critical heuristic for containing a large number of external links, specifically pointing to a website hosting numerous PDF files. The ML classifier also strongly indicated maliciousness. While no scripts were extracted, the sheer volume of linked PDFs suggests a coordinated effort to drive traffic or distribute content from the `gorillawalker.com` domain, potentially for SEO manipulation or as a distribution point for further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9016

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/moscow-the-turning-point-the-failure-of-hitler-s-strategy.pdf
    • http://www.gorillawalker.com/side-by-side-book-1b.pdf
    • http://www.gorillawalker.com/cartesian-psychology-and-physical-minds-individualism-and-the-science-of.pdf
    • http://www.gorillawalker.com/custom-business-resources-pearson-custom-business-resources.pdf
    • http://www.gorillawalker.com/jack-stalwart-the-quest-for-aztec-gold-mexico-book-10.pdf
    • http://www.gorillawalker.com/the-youth-theatre-director-s-handbook.pdf
    • http://www.gorillawalker.com/1-parent-a-go-to-guide-for-new-single-parents.pdf
    • http://www.gorillawalker.com/unwound-the-symphony-of-brass-and-bone-volume-1.pdf
    • http://www.gorillawalker.com/designing-stock-market-trading-systems-with-and-without-soft-computing.pdf
    • http://www.gorillawalker.com/adaptive-filtering-prediction-and-control-prentice-hall-information-and-system.pdf
    • http://www.gorillawalker.com/substance-abuse-treatment-a-companion-to-the-american-psychiatric-publishing.pdf
    • http://www.gorillawalker.com/against-reform-u-of-t-centre-for-public-management-series.pdf
    • http://www.gorillawalker.com/40-days-beyond-the-veil.pdf
    • http://www.gorillawalker.com/killing-pablo-the-hunt-for-the-richest-most-powerful-criminal.pdf
    • http://www.gorillawalker.com/21-prayers-of-gratitude-overcoming-negativity-through-the-power-of.pdf
    • http://www.gorillawalker.com/in-search-of-politics.pdf
    • http://www.gorillawalker.com/lectura-veloz-y-mas-para-profesionales-y-corporativos-m-todos.pdf
    • http://www.gorillawalker.com/pollutants-human-health-and-the-environment-a-risk-based-approach.pdf
    • http://www.gorillawalker.com/hard-bop-jazz-and-black-music-1955-1965.pdf
    • http://www.gorillawalker.com/coral-reefs.pdf
    • http://www.gorillawalker.com/first-steps-in-retail-management.pdf
    • http://www.gorillawalker.com/service-management-the-new-paradigm-in-retailing.pdf
    • http://www.gorillawalker.com/the-struggle-for-water-politics-rationality-and-identity-in-the.pdf
    • http://www.gorillawalker.com/economics-theory-and-researches.pdf
    • http://www.gorillawalker.com/bac-si-a-novel.pdf
    • http://www.gorillawalker.com/disc-nkjv-complete-bible-nylon-zip-60-cd.pdf
    • http://www.gorillawalker.com/the-complete-guide-to-walt-disney-world.pdf
    • http://www.gorillawalker.com/introduction-to-radiologic-and-imaging-sciences-and-patient-care-6e.pdf
    • http://www.gorillawalker.com/how-to-perfect-your-golf-swing-using-connection-and-the.pdf
    • http://www.gorillawalker.com/sun-after-dark-flights-into-the-foreign.pdf
    • http://www.gorillawalker.com/the-craigslist-hustle.pdf
    • http://www.gorillawalker.com/national-geographic-school-bulletin-sept-22-1969-no-2.pdf
    • http://www.gorillawalker.com/the-complete-guide-on-hp-loadrunner-web-controller.pdf
    • http://www.gorillawalker.com/swami-vivekananda-the-living-vedanta.pdf
    • http://www.gorillawalker.com/fun-learning-facts-about-monkeys-illustrated-fun-learning-for-kids.pdf
    • http://www.gorillawalker.com/the-parental-rights-of-rapists-an-article-from-duke-journal.pdf
    • http://www.gorillawalker.com/the-brain-and-behavior-an-introduction-to-behavioral-neuroanatomy-cambridge.pdf
    • http://www.gorillawalker.com/life-and-flowers.pdf
    • http://www.gorillawalker.com/heroes-longman-african-writers.pdf
    • http://www.gorillawalker.com/the-pocket-small-business-owner-s-guide-to-taxes-pocket.pdf
    • http://www.gorillaw
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.