Malicious PDF — malware analysis report

Static analysis result for SHA-256 4504613a8704cd4a…

MALICIOUS

PDF

45.8 KB Created: 2018-12-14 20:00:42 +03:00 Authoring application: FrameMaker 7.0 (via Acrobat Distiller 5.0.5 (Windows))
MD5: f9529e2373f7e4bb6b1a54ea99987456 SHA-1: 2911d461596c2e6737abacef27966577c42d6565 SHA-256: 4504613a8704cd4a9d8c4afbe28eec55b5fcab810bf42ee3e73b50a42cbafe2a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, all hosted on the domain 'gorillawalker.com'. This pattern is indicative of SEO poisoning or a link farm designed to drive traffic to malicious or low-quality content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8974

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/domestic-spying-wiretap-in-the-news.pdf
    • http://www.gorillawalker.com/ruined-hearts.pdf
    • http://www.gorillawalker.com/israel-a-travel-survival-kit.pdf
    • http://www.gorillawalker.com/academic-library-centrality-user-success-through-service-access-and-tradition.pdf
    • http://www.gorillawalker.com/the-energy-manager-s-handbook.pdf
    • http://www.gorillawalker.com/mi-primera-biblia-en-cuadros-rosa-my-first-bible-in.pdf
    • http://www.gorillawalker.com/electric-power-systems-electrical-grid-fundamentals-and-sustainable-power-integration.pdf
    • http://www.gorillawalker.com/left-to-the-wolves-irish-victims-of-stalinist-terror.pdf
    • http://www.gorillawalker.com/how-to-raise-silk-worms-a-brief-manual-of-instructions.pdf
    • http://www.gorillawalker.com/the-french-revolution-its-causes-its-history-and-its-legacy.pdf
    • http://www.gorillawalker.com/wolfgang-puck-makes-it-healthy-light-delicious-recipes-and-easy.pdf
    • http://www.gorillawalker.com/agile-project-management-explained-business-school-books-volume-4.pdf
    • http://www.gorillawalker.com/a-parent-s-guide-to-teaching-kids-to-play.pdf
    • http://www.gorillawalker.com/the-roman-assemblies-from-their-origin-to-the-end-of.pdf
    • http://www.gorillawalker.com/writings-on-church-and-reform-the-i-tatti-renaissance-library.pdf
    • http://www.gorillawalker.com/hungry-ghosts-one-woman-s-mission-to-change-their-world.pdf
    • http://www.gorillawalker.com/rheology-principles-measurements-and-applications.pdf
    • http://www.gorillawalker.com/10-simple-solutions-to-adult-add-how-to-overcome-chronic.pdf
    • http://www.gorillawalker.com/the-zohar-volume-23-by-rav-shimon-bar-yochai-from.pdf
    • http://www.gorillawalker.com/testing-deaf-students-in-an-age-of-accountability.pdf
    • http://www.gorillawalker.com/the-far-traveller-a-gay-and-ghostly-affair.pdf
    • http://www.gorillawalker.com/jimmy-carter-and-the-energy-crisis-of-the-1970s-the.pdf
    • http://www.gorillawalker.com/lions-tigers-leopards-more-discovery-kids-discovery-kids-3d-readers.pdf
    • http://www.gorillawalker.com/jan-de-witt-s-elementa-curvarum-linearum-liber-secundus-sources.pdf
    • http://www.gorillawalker.com/pasi-n-incontrolada-selecci-n-rnr-spanish-edition.pdf
    • http://www.gorillawalker.com/poems-for-the-millennium-the-university-of-california-book-of.pdf
    • http://www.gorillawalker.com/a-consensualidade-na-administra-o-p-blica-portuguese-edition.pdf
    • http://www.gorillawalker.com/fodor-s-pocket-savannah-and-charleston-5th-edition-pocket-guides.pdf
    • http://www.gorillawalker.com/the-mystery-of-the-class-clown-an-article-from-children.pdf
    • http://www.gorillawalker.com/listening-woman.pdf
    • http://www.gorillawalker.com/endoscopic-anatomy-of-the-third-ventricle-microsurgical-and-endoscopic-approaches.pdf
    • http://www.gorillawalker.com/everdark-the-dark-ink-chronicles.pdf
    • http://www.gorillawalker.com/time-travel-adventures-of-the-1800-club-book-5-kindle.pdf
    • http://www.gorillawalker.com/history-and-genealogy-of-william-cunningham-and-wife-nancy-carr.pdf
    • http://www.gorillawalker.com/glossary-of-defense-acquisition-acronyms-terms-14th-edition-july-2011.pdf
    • http://www.gorillawalker.com/color-me-english-reflections-on-migration-and-belonging.pdf
    • http://www.gorillawalker.com/thundercats-reclaiming-thundera.pdf
    • http://www.gorillawalker.com/handbook-of-basic-pharmacokinetics-including-clinical-applications.pdf
    • http://www.gorillawalker.com/who-s-minding-the-store.pdf
    • http://www.gorillawalker.com/the-sleepy-babysitter-violent-size-erotica.pdf
    • http://www.gorillawalker.com/left-to-the-wolves-irish-vict
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.