Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a36d77353e172cb…

MALICIOUS

PDF

43.2 KB Created: 2018-11-30 20:15:15 +03:00 Authoring application: Acrobat PDFMaker 7.0 for Publisher (via Acrobat Distiller 7.0 (Windows))
MD5: c055b67056199160cb77585763768468 SHA-1: 1336ced399a8a6aa808f94f28d0c3c73f7f36b73 SHA-256: 4a36d77353e172cbc32f3b09d51372c9f1b0da8eeee46a1a18125542dbfec2e6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, primarily hosted on www.gorillawalker.com. This behavior is indicative of a link farm or SEO spam technique, potentially used to distribute malicious content or manipulate search engine rankings. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/woodland-dell-s-secret-whispering-brook.pdf
    • http://www.gorillawalker.com/scott-s-official-history-of-reggae-the-original-wailers-reggae.pdf
    • http://www.gorillawalker.com/putting-together-the-puzzle-of-the-new-testament.pdf
    • http://www.gorillawalker.com/grand-hotel-new-complete-edition.pdf
    • http://www.gorillawalker.com/nachhaltige-geb-udetechnik-detail-green-books-german-edition.pdf
    • http://www.gorillawalker.com/word-biblical-commentary-vol-33a-matthew-1-13-hagner-483pp.pdf
    • http://www.gorillawalker.com/tribology-data-handbook-an-excellent-friction-lubrication-and-wear-resource.pdf
    • http://www.gorillawalker.com/the-road-to-oxiana-penguin-travel-library.pdf
    • http://www.gorillawalker.com/psychotherapy-and-existentialism-selected-papers-on-logotherapy.pdf
    • http://www.gorillawalker.com/food-as-communication-communication-as-food.pdf
    • http://www.gorillawalker.com/elm-creek-quilts-playing-cards-single-pack.pdf
    • http://www.gorillawalker.com/unmasqued-an-erotic-novel-of-the-phantom-of-the-opera.pdf
    • http://www.gorillawalker.com/common-lisp-and-artificial-intelligence.pdf
    • http://www.gorillawalker.com/the-porcelain-thief-searching-the-middle-kingdom-for-buried-china.pdf
    • http://www.gorillawalker.com/dios-no-tiene-favoritos-tiene.pdf
    • http://www.gorillawalker.com/stretching-scientifically-a-guide-to-flexibility-training.pdf
    • http://www.gorillawalker.com/southern-marches-of-imperial-ethiopia-essays-in-history-and-social.pdf
    • http://www.gorillawalker.com/magic-the-gathering-strategy-and-deck-building-tips-a-complete.pdf
    • http://www.gorillawalker.com/fda-panel-cautiously-favors-inhaled-insulin-news-an-article-from.pdf
    • http://www.gorillawalker.com/kildar-paladin-of-shadows-book-2-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/deep-peril.pdf
    • http://www.gorillawalker.com/the-seven-mysteries-of-life-an-exploration-of-science-and.pdf
    • http://www.gorillawalker.com/veg-out-vegetarian-guide-to-seattle-and-portland-vegout-vegetarian.pdf
    • http://www.gorillawalker.com/my-boyfriend-s-dad-billionaire-alpha-taken-at-the-office.pdf
    • http://www.gorillawalker.com/the-alaska-bush-pilot-chronicles-more-adventures-and-misadventures-from.pdf
    • http://www.gorillawalker.com/sonata-no-10-in-b-minor-for-alto-recorder-and.pdf
    • http://www.gorillawalker.com/caballeros-y-castillos-mi-pequena-enciclopedia-spanish-edition.pdf
    • http://www.gorillawalker.com/sunday-morning-shamwana-a-midwife-s-letters-from-the-field.pdf
    • http://www.gorillawalker.com/beyond-the-scent-of-olives-kindle-edition.pdf
    • http://www.gorillawalker.com/alkaloids-chemical-and-biological-perspectives-volume-13-volume-13.pdf
    • http://www.gorillawalker.com/coast-to-coast-with-wainwright.pdf
    • http://www.gorillawalker.com/one-reason-to-live-conversations-about-music-with-julius-nil.pdf
    • http://www.gorillawalker.com/russian-food-cooking.pdf
    • http://www.gorillawalker.com/rune-magic.pdf
    • http://www.gorillawalker.com/the-fugitive-poets-modern-southern-poetry-southern-classics-series.pdf
    • http://www.gorillawalker.com/the-miracle-the-epic-story-of-asia-s-quest-for.pdf
    • http://www.gorillawalker.com/the-girl-in-the-song-the-stories-behind-50-rock.pdf
    • http://www.gorillawalker.com/john-coltrane-improvised-saxophone-solos.pdf
    • http://www.gorillawalker.com/scenes-songs-solos-a-composition-and-improvisation-workbook-for-the.pdf
    • http://www.gorillawalker.com/how-to-play-harmonica-beginner-s-instructions-for-breathing-rhythm.pdf
    • http://www.gorillawalker
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.