Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ae038cd36fd2025…

MALICIOUS

PDF

41.7 KB Created: 2018-11-30 20:57:18 +03:00 Authoring application: - (via Acrobat Distiller 7.0 (Windows))
MD5: 6d5475b6140200876aa5ddb499485573 SHA-1: cb287e9a2b59a8e211d5a63cd12e0563ca3113d3 SHA-256: 4ae038cd36fd2025a837b7de7158c9004afed07d757730e834770bbd806bd099
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious and contains a large number of embedded links to external PDF files. The heuristic 'PDF_SEO_LINK_FARM' indicates that the document is designed to link to 32 external PDFs, with the first being http://www.gorillawalker.com/journey-s-edge.pdf. This suggests a tactic to manipulate search engine results or to distribute a large volume of content, potentially malicious, through a link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/journey-s-edge.pdf
    • http://www.gorillawalker.com/official-price-guide-to-bottles.pdf
    • http://www.gorillawalker.com/1000-ejercicios-y-juegos-de-voleibol-y-minivolei-1000-exercises.pdf
    • http://www.gorillawalker.com/policy-issues-for-business-a-reader.pdf
    • http://www.gorillawalker.com/get-rid-of-acne-scars-kindle-edition.pdf
    • http://www.gorillawalker.com/nosotros-si-podemos-hacerlo-spanish-edition.pdf
    • http://www.gorillawalker.com/conquest-of-cancer-vaccines-and-diet.pdf
    • http://www.gorillawalker.com/electromagnetic-sounding-of-the-earth-s-interior-volume-40-methods.pdf
    • http://www.gorillawalker.com/cave-refectory-road.pdf
    • http://www.gorillawalker.com/st-paul-but-the-lord-is-mindful-of-his-own.pdf
    • http://www.gorillawalker.com/calvin-of-prayer-and-the-christian-life-selected-writings-from.pdf
    • http://www.gorillawalker.com/wine-an-indispensable-guide-to-the-world-s-finest-wines.pdf
    • http://www.gorillawalker.com/travels-through-holland-flanders-germany-denmark-sweden-lapland-russia-the.pdf
    • http://www.gorillawalker.com/a-passion-for-tango-kindle-edition.pdf
    • http://www.gorillawalker.com/iec-60079-14-ed-3-0-b-2002-electrical-apparatus.pdf
    • http://www.gorillawalker.com/the-garlic-lovers-cookbook-vol-1.pdf
    • http://www.gorillawalker.com/tastes-like-home-my-caribbean-cookbook.pdf
    • http://www.gorillawalker.com/bleach-3-in-1-edition-vol-2-includes-vols-4.pdf
    • http://www.gorillawalker.com/kein-mensch-ist-ohne-vorurteile-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/human-remains-guide-for-museums-and-academic-institutions.pdf
    • http://www.gorillawalker.com/ayrton-senna-the-hard-edge-of-genius.pdf
    • http://www.gorillawalker.com/conservation-environmental-issues.pdf
    • http://www.gorillawalker.com/la-scienza-in-cucina-e-l-arte-di-mangiar-bene.pdf
    • http://www.gorillawalker.com/making-android-accessories-with-ioio.pdf
    • http://www.gorillawalker.com/veterinarian-careers-with-animals.pdf
    • http://www.gorillawalker.com/arabic-as-a-secret-song-caraf-books-caribbean-and-african.pdf
    • http://www.gorillawalker.com/deep-dive-4-kraya-the-blood-shark.pdf
    • http://www.gorillawalker.com/calor-spanish-edition.pdf
    • http://www.gorillawalker.com/imitation-of-christ.pdf
    • http://www.gorillawalker.com/the-greenwood-guide-to-american-popular-culture-vol-4-pulps.pdf
    • http://www.gorillawalker.com/the-land-of-the-white-elephant-sights-and-scenes-in.pdf
    • http://www.gorillawalker.com/the-phlebotomy-textbook.pdf
    • http://www.gorillawalker.com/the-next-step-50-more-things-you-can-do-to.pdf
    • http://www.gorillawalker.com/physics-made-simple-i-alchemy-to-quarks-the-quest-for.pdf
    • http://www.gorillawalker.com/khan-a-maine-coon-kindle-edition.pdf
    • http://www.gorillawalker.com/scenic-art-for-the-theatre.pdf
    • http://www.gorillawalker.com/holy-terrors-gargoyles-on-medieval-buildings.pdf
    • http://www.gorillawalker.com/phantasmagoria-scandalous-seductions-book-3.pdf
    • http://www.gorillawalker.com/politics-and-government-in-california-14th-edition.pdf
    • http://www.gorillawalker.com/the-greatest-gift-guide-ever.pdf
    • http://www.gorillawalker.com/nosotros-si-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.