Malicious PDF — malware analysis report

Static analysis result for SHA-256 4602c4873ca21313…

MALICIOUS

PDF

45.2 KB Created: 2019-01-06 08:24:33 +03:00 Authoring application: TeX (via MiKTeX pdfTeX-1.10b)
MD5: 2d7c8735fcbe8c5bc46b19e15dcaf921 SHA-1: 7857153ee8fdb5e58c077b38edcad6e5477c9898 SHA-256: 4602c4873ca21313d8613d782155534b18f66c3bb09cfe98904549c7266a8dcc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document as malicious. The embedded URLs point to various PDF documents hosted on www.gorillawalker.com, suggesting a link farm or SEO manipulation tactic. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8452

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/metallurgie-extractive-du-cobalt-french-edition.pdf
    • http://www.gorillawalker.com/coding-companion-for-oncology-hematology-2009.pdf
    • http://www.gorillawalker.com/dunkle-liebe-die-leopardenmenschen-saga-5-roman-german-edition.pdf
    • http://www.gorillawalker.com/introduction-to-aviation-insurance-and-risk-management.pdf
    • http://www.gorillawalker.com/lpic-2-linux-professional-institute-certification-study-guide-exams-201.pdf
    • http://www.gorillawalker.com/storia-della-letteratura-italiana.pdf
    • http://www.gorillawalker.com/one-flash-great-photography-with-just-one-speedlight.pdf
    • http://www.gorillawalker.com/the-literacy-teacher-s-playbook-grades-k-2-four-steps.pdf
    • http://www.gorillawalker.com/poland-road-maps.pdf
    • http://www.gorillawalker.com/j-s-bach-six-cello-suites-for-saxophone.pdf
    • http://www.gorillawalker.com/en-el-armario-spanish-edition.pdf
    • http://www.gorillawalker.com/single-parent-families-sage-sourcebooks-for-the-human-services.pdf
    • http://www.gorillawalker.com/knights-of-light-the-conjurors-series-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/fujiwara-san-collection-for-clarinet-solo-sheet-music-book-vocaloid.pdf
    • http://www.gorillawalker.com/specialized-cataloging-and-classification-theory-and-technique-volume-ii-primary.pdf
    • http://www.gorillawalker.com/peacemakers-kindle-edition.pdf
    • http://www.gorillawalker.com/silverback-shift-m-m-shifter-mpreg-romance.pdf
    • http://www.gorillawalker.com/mcdougal-littell-school-spelling-student-edition-consumable-grade-3-1990.pdf
    • http://www.gorillawalker.com/the-politics-of-production-factory-regimes-under-capitalism-and-socialism.pdf
    • http://www.gorillawalker.com/anthology-of-british-literature-vol-2-package-5th-edition.pdf
    • http://www.gorillawalker.com/awakening-love-teachings-and-practices-to-cultivate-a-limitless-heart.pdf
    • http://www.gorillawalker.com/wounded-rangers-under-enemy-fire-in-afghanistan.pdf
    • http://www.gorillawalker.com/music-minus-one-clarinet-new-orleans-classics-sheet-music-and.pdf
    • http://www.gorillawalker.com/3-piano-trios-hob-xv-24-26-op-82-trio.pdf
    • http://www.gorillawalker.com/disaster-movies-the-cinema-of-catastrophe-short-cuts.pdf
    • http://www.gorillawalker.com/how-to-publish-a-book-sell-a-million-copies.pdf
    • http://www.gorillawalker.com/general-relativity-an-introduction-to-the-theory-of-gravitational-field.pdf
    • http://www.gorillawalker.com/icts-apt-assessment-of-professional-teaching-test-101-104.pdf
    • http://www.gorillawalker.com/verde-por-fuera-libro-de-adivinanzas-para-los-que-saben.pdf
    • http://www.gorillawalker.com/manual-of-british-water-engineering-practice-volume-i-organization-and.pdf
    • http://www.gorillawalker.com/cisco-int-l-selects-ag-group-s-network-management-tools.pdf
    • http://www.gorillawalker.com/mystery-mansion-young-reading-series-2.pdf
    • http://www.gorillawalker.com/sterling-ap-chemistry-practice-questions-high-yield-ap-chemistry-questions.pdf
    • http://www.gorillawalker.com/curso-basico-de-pilates.pdf
    • http://www.gorillawalker.com/creating-sociological-awareness-collective-images-and-symbolic-representations.pdf
    • http://www.gorillawalker.com/adventures-in-ancient-egypt.pdf
    • http://www.gorillawalker.com/gameplayer.pdf
    • http://www.gorillawalker.com/the-historically-annotated-legend-of-sleepy-hollow.pdf
    • http://www.gorillawalker.com/ice-cream-queen.pdf
    • http://www.gorillawalker.com/tales-of-cusco.pdf
    • http://www.gorillawal
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.