Malicious PDF — malware analysis report

Static analysis result for SHA-256 46f3591f3c09ba6b…

MALICIOUS

PDF

45.2 KB Created: 2018-11-14 11:20:37 +03:00 Authoring application: mPDF 6.0
MD5: 9a84b50fb03f06230c6515ffa08b07ba SHA-1: f8d637efb7da30827f4a380eac439344dad1ea34 SHA-256: 46f3591f3c09ba6b748b4dd6f8d7a4b494073d1132f54d173e2d9e83b8127d32
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links pointing to PDF documents on the domain www.gorillawalker.com. This suggests a link farm or redirection tactic to distribute further content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/kids-in-the-syndrome-mix-of-adhd-ld-autism-spectrum.pdf
    • http://www.gorillawalker.com/what-s-your-problem-identifying-and-solving-the-five-types.pdf
    • http://www.gorillawalker.com/the-2009-2014-world-outlook-for-automotive-diesel-fuel.pdf
    • http://www.gorillawalker.com/no-mistakes-resumes-how-to-write-a-resume-that-will.pdf
    • http://www.gorillawalker.com/bcom-5-with-coursemate-printed-access-card-engaging-4ltr-press.pdf
    • http://www.gorillawalker.com/let-s-read-a-linguistic-approach.pdf
    • http://www.gorillawalker.com/el-evangelio-de-la-nueva-vida-spanish-edition.pdf
    • http://www.gorillawalker.com/lightroom-5-streamlining-your-digital-photography-process.pdf
    • http://www.gorillawalker.com/chemical-engineering-kinetics.pdf
    • http://www.gorillawalker.com/colposcopy-cervical-pathology-textbook-and-atlas.pdf
    • http://www.gorillawalker.com/saving-on-a-shoestring-how-to-cut-expenses-reduce-debt.pdf
    • http://www.gorillawalker.com/hank-williams-the-greatest-hits-piano-vocal-chords.pdf
    • http://www.gorillawalker.com/savoury-pie-and-quiche-cookbook-delicious-mouth-watering-pie-and.pdf
    • http://www.gorillawalker.com/latin-ultimate-course-with-book-latin-edition.pdf
    • http://www.gorillawalker.com/arousing-the-fury-of-the-immune-system-new-ways-to.pdf
    • http://www.gorillawalker.com/call-center-technology-demystified-the-no-nonsense-guide-to-bridging.pdf
    • http://www.gorillawalker.com/picasso-s-women-eight-monologues-oberon-books.pdf
    • http://www.gorillawalker.com/statistics-for-engineering-and-scientists-connect-access-card-for-statistics.pdf
    • http://www.gorillawalker.com/a-clients-guide-to-limited-legal-services-a-simple-and.pdf
    • http://www.gorillawalker.com/work-rules-insights-from-inside-google-that-will-transform-how.pdf
    • http://www.gorillawalker.com/root-cause-analysis-basic-tools-and-techniques.pdf
    • http://www.gorillawalker.com/motherhood-a-gift-of-love-miniature-editions.pdf
    • http://www.gorillawalker.com/filicide-the-mythic-reality-of-childhood.pdf
    • http://www.gorillawalker.com/practical-problems-in-mathematics-for-electronic-technicians-6e-practical-problems.pdf
    • http://www.gorillawalker.com/easy-gardens-for-the-south.pdf
    • http://www.gorillawalker.com/endang-extinct-prehist-anima-endangered-and-extinct.pdf
    • http://www.gorillawalker.com/machiavelli-the-chief-works-and-others-vol-2.pdf
    • http://www.gorillawalker.com/the-complete-stems-and-branches-time-and-space-in-traditional.pdf
    • http://www.gorillawalker.com/orthodontics-in-the-vertical-dimension-a-case-based-review.pdf
    • http://www.gorillawalker.com/flatland-xist-classics.pdf
    • http://www.gorillawalker.com/hart-crane-and-allen-tate.pdf
    • http://www.gorillawalker.com/the-law-governing-lawyers-national-rules-standards-statutes-and-lawyer.pdf
    • http://www.gorillawalker.com/ben-zip-two-short-friends.pdf
    • http://www.gorillawalker.com/vampire-loves.pdf
    • http://www.gorillawalker.com/classic-stories-exciting-timeless-tales-from-outdoor-life-s-greatest.pdf
    • http://www.gorillawalker.com/collins-big-cat-sets-pearl-starter-set-band-18-pearl.pdf
    • http://www.gorillawalker.com/filosofia-del-punk-mucho-mas-que-solo-ruido-spanish-edition.pdf
    • http://www.gorillawalker.com/michelin-spain-portugal-tourist-and-motoring-atlas-michelin-spain-portugal.pdf
    • http://www.gorillawalker.com/the-life-of-benjamin-banneker-astronomer-and-mathematician-legendary-african.pdf
    • http://www.gorillawalker.com/the-historical-origin-of-islam.pdf
    • http://www.gorillawalker.com/el-evangelio
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.