Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bdd4e9b8e10ea7f…

MALICIOUS

PDF

33.7 KB Created: 2019-09-15 19:24:43 +03:00 Authoring application: PScript5.dll Version 5.2 (via GPL Ghostscript 8.15)
MD5: 38a060d463177bcf5d43c45f3b89d0ea SHA-1: fa5603c09edfdc092b0c65cb098591deb0b64d47 SHA-256: 4bdd4e9b8e10ea7f92ff89208737ada39fd2af1e1d2a2589912c36dc3ca74441
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be a link farm, directing users to numerous URLs hosted on www.gorillawalker.com, likely for SEO manipulation or to serve further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8313

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/temptation-is-the-night-kindle-edition.pdf
    • http://www.gorillawalker.com/how-to-animate-film-cartoons-how-to-draw-and-paint.pdf
    • http://www.gorillawalker.com/the-corcoran-affair.pdf
    • http://www.gorillawalker.com/thunder-at-dawn.pdf
    • http://www.gorillawalker.com/grammar-for-babies-book-1-carlos-the-comma-kindle-edition.pdf
    • http://www.gorillawalker.com/research-design-in-counseling-research-statistics-program-evaluation.pdf
    • http://www.gorillawalker.com/shadow-bride-brides-of-montclair-book-7.pdf
    • http://www.gorillawalker.com/letters-to-my-son-reflections-on-becoming-a-man.pdf
    • http://www.gorillawalker.com/no-witnesses-to-nothing.pdf
    • http://www.gorillawalker.com/lsat-mac-cliffs-studyware.pdf
    • http://www.gorillawalker.com/adventures-around-the-globe-packed-full-of-maps-activities-and.pdf
    • http://www.gorillawalker.com/cambridge-igcse-and-international-certificate-german-foreign-language-grammar-workbook.pdf
    • http://www.gorillawalker.com/abernathy-s-cases-and-materials-on-civil-rights-and-constitutional.pdf
    • http://www.gorillawalker.com/key-takeaways-analysis-of-christiane-northrup-m-d-s-goddesses.pdf
    • http://www.gorillawalker.com/calculus-graphical-numerical-algebraic-solutions-manual.pdf
    • http://www.gorillawalker.com/principles-and-practice-of-intensive-care-monitoring.pdf
    • http://www.gorillawalker.com/practical-art-anatomy.pdf
    • http://www.gorillawalker.com/approaching-the-standards-jazz-improvisation-series-vol-3.pdf
    • http://www.gorillawalker.com/pilgrims-on-the-earth-a-german-russian-chronicle.pdf
    • http://www.gorillawalker.com/we-ve-got-to-start-meeting-like-this-creating-inspiring.pdf
    • http://www.gorillawalker.com/white-shanghai-a-novel-of-the-roaring-twenties-in-china.pdf
    • http://www.gorillawalker.com/major-problems-in-american-colonial-history-major-problems-in-american.pdf
    • http://www.gorillawalker.com/eggs-and-poultry-made-at-home.pdf
    • http://www.gorillawalker.com/the-unknowable-discrete-mathematics-and-theoretical-computer-science.pdf
    • http://www.gorillawalker.com/until-the-last-star-falls.pdf
    • http://www.gorillawalker.com/death-taxes-and-silver-spurs-a-tara-holloway-novel.pdf
    • http://www.gorillawalker.com/sex-and-the-city-2-the-stories-the-fashion-the.pdf
    • http://www.gorillawalker.com/ukraine-moldavia-road-map-road-maps-english-french-italian-german.pdf
    • http://www.gorillawalker.com/contemporary-geriatric-medicine-volume-2.pdf
    • http://www.gorillawalker.com/wood-and-tree-fungi-biology-damage-protection-and-use.pdf
    • http://www.gorillawalker.com/mission-shanghai-kindle-edition.pdf
    • http://www.gorillawalker.com/what-every-child-needs-to-know-about-coffee.pdf
    • http://www.gorillawalker.com/a-premium-support-system-for-medicare-analysis-of-illustrative-options.pdf
    • http://www.gorillawalker.com/the-christians-as-the-romans-saw-them.pdf
    • http://www.gorillawalker.com/a-new-england-country-veterinarian.pdf
    • http://www.gorillawalker.com/carpentry-residential-construction-academy.pdf
    • http://www.gorillawalker.com/paired-passages-linking-fact-to-fiction-grd-2.pdf
    • http://www.gorillawalker.com/hungarian-cooking-simple-and-economical-recipes.pdf
    • http://www.gorillawalker.com/early-support-for-children-with-complex-needs-team-around-the.pdf
    • http://www.gorillawalker.com/the-passover-seder-pathways-through-the-haggadah.pdf
    • http://www.gorillawalker.com/cambridge-igcse-and-interna
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.