Malicious PDF — malware analysis report

Static analysis result for SHA-256 49fe43a21f643056…

MALICIOUS

PDF

44.1 KB Created: 2018-11-30 01:49:15 +03:00 Authoring application: LaTeX with hyperref package (via pdfTeX-1.40.17)
MD5: c7972a86921627ac0e0128d89f34cb20 SHA-1: d46c0c2478a86890a65d94b9a999951408d4bcef SHA-256: 49fe43a21f643056d87b2c2f83dcaf54ecaf4d207b6a1d4dc43391fd4a9ab42f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, primarily hosted on www.gorillawalker.com. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute potentially malicious content disguised as legitimate documents. The ML classifier also flagged this PDF as malicious with a high score.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-writer-s-digest-sourcebook-for-building-believable-characters.pdf
    • http://www.gorillawalker.com/polish-fairy-tales-classic-reprint.pdf
    • http://www.gorillawalker.com/a-creative-guide-to-knitted-lace.pdf
    • http://www.gorillawalker.com/continuum-mechanics-using-mathematica-fundamentals-applications-and-scientific-computing-modeling.pdf
    • http://www.gorillawalker.com/the-witch-s-dream-a-healer-s-way-of-knowledge.pdf
    • http://www.gorillawalker.com/beach-bag-reads-rogue-reads-anthology-book-1.pdf
    • http://www.gorillawalker.com/ihs-jane-s-all-the-world-s-aircraft-in-service.pdf
    • http://www.gorillawalker.com/the-psychology-of-advertising.pdf
    • http://www.gorillawalker.com/acanthaster-planci-impact-on-pacific-coral-reefs.pdf
    • http://www.gorillawalker.com/on-latinidad-u-s-latino-literature-and-the-construction-of.pdf
    • http://www.gorillawalker.com/pete-won-146-t-eat-i-like-to-read-i.pdf
    • http://www.gorillawalker.com/recycled-material-prices-lower-your-business-recycle-pricing-an-article.pdf
    • http://www.gorillawalker.com/hipaa-plain-and-simple-a-compliance-guide-for-healthcare-professionals.pdf
    • http://www.gorillawalker.com/relationship-economics-transform-your-most-valuable-business-contacts-into-personal.pdf
    • http://www.gorillawalker.com/from-boys-to-men-a-woman-s-guide-to-the.pdf
    • http://www.gorillawalker.com/is-shame-necessary-new-uses-for-an-old-tool.pdf
    • http://www.gorillawalker.com/your-finances-in-changing-times-christian-financial-concepts-series.pdf
    • http://www.gorillawalker.com/black-lace-quickies-5.pdf
    • http://www.gorillawalker.com/the-art-of-beer-pairing-a-quick-guide-to-expertly.pdf
    • http://www.gorillawalker.com/broken-boys-mending-men-recovery-from-childhood-sexual-abuse.pdf
    • http://www.gorillawalker.com/miss-moore-thought-otherwise-how-anne-carroll-moore-created-libraries.pdf
    • http://www.gorillawalker.com/korean-music-and-dance.pdf
    • http://www.gorillawalker.com/handbook-of-clinical-dietetics-second-edition.pdf
    • http://www.gorillawalker.com/free-grace-broadcaster-issue-213-contentment-kindle-edition.pdf
    • http://www.gorillawalker.com/probability-statistics-and-reliability-for-engineers-and-scientists-third-edition.pdf
    • http://www.gorillawalker.com/the-moths-of-america-north-of-mexico-fascicle-15-2.pdf
    • http://www.gorillawalker.com/principles-of-naval-engineering-addendum-color-diagrams.pdf
    • http://www.gorillawalker.com/jesus-the-exorcist-a-contribution-to-the-study-of-the.pdf
    • http://www.gorillawalker.com/the-myths-of-the-north-american-indians-native-american.pdf
    • http://www.gorillawalker.com/siam-through-the-lens-of-john-thomson-1865-66.pdf
    • http://www.gorillawalker.com/mentiras-inconfesables-deseo-spanish-edition.pdf
    • http://www.gorillawalker.com/elvis-presley-the-king-achievers.pdf
    • http://www.gorillawalker.com/handbook-of-mining-details-compiled-from-the-engineering-and-mining.pdf
    • http://www.gorillawalker.com/close-up.pdf
    • http://www.gorillawalker.com/peaceful-warrior-the-graphic-novel-peaceful-warrior-saga.pdf
    • http://www.gorillawalker.com/bosnia-and-herzegovina-business-intelligence-report.pdf
    • http://www.gorillawalker.com/creating-more-effective-graphs.pdf
    • http://www.gorillawalker.com/the-papers-of-george-washington-15-january-7-april-1779.pdf
    • http://www.gorillawalker.com/adventures-in-leadership.pdf
    • http://www.gorillawalker.com/classical-japanese-a-grammar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.