Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ff7a1cbff97bab1…

MALICIOUS

PDF

32.1 KB Created: 2019-12-09 21:38:58 +03:00 Authoring application: QuarkXPress(R) 9.54
MD5: f1bcf6e1cc022bcd9cda362f7c73c3a9 SHA-1: 095357917c21614cdd033b0410bbf65ef5396d86 SHA-256: 4ff7a1cbff97bab1aa75892ec3517fa825fe453e1c33f7ff897ec0c889ee2091
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The document body contains numerous URLs pointing to PDFs hosted on www.gorillawalker.com, suggesting a link farm or distribution mechanism. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8488

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-outrageous-barriers-to-democracy-in-america-or-why-a.pdf
    • http://www.gorillawalker.com/sex-power-conflict-evolutionary-and-feminist-perspectives.pdf
    • http://www.gorillawalker.com/theory-of-blackjack.pdf
    • http://www.gorillawalker.com/btooom-3.pdf
    • http://www.gorillawalker.com/how-creative-workers-learn-develop-your-career-with-emergent-learning.pdf
    • http://www.gorillawalker.com/hold-your-shape-gymnastics-conditioning-flip-booklet.pdf
    • http://www.gorillawalker.com/the-new-starting-right-with-bees.pdf
    • http://www.gorillawalker.com/relational-presentation-a-visually-interactive-approach-2007-edition.pdf
    • http://www.gorillawalker.com/americanmedical-association-guide-to-preventing-and-treating-heart-disease-byassociation.pdf
    • http://www.gorillawalker.com/niosh-health-hazard-evaluation-report-heta-2006-0059-3009-daimlerchrysler.pdf
    • http://www.gorillawalker.com/beginnings-of-interior-environments-11th-edition-fashion-series.pdf
    • http://www.gorillawalker.com/spooktacular-naughtiness-things-that-go-hump-in-the-night-erotica.pdf
    • http://www.gorillawalker.com/columbus-was-last.pdf
    • http://www.gorillawalker.com/el-cat-logo-brillante-del-artista-vasili-s-rikov-el.pdf
    • http://www.gorillawalker.com/current-occupational-environmental-medicine-4th-fourth-edition-byladou.pdf
    • http://www.gorillawalker.com/home-networking-annoyances-how-to-fix-the-most-annoying-things.pdf
    • http://www.gorillawalker.com/lewis-and-clark-world-explorers.pdf
    • http://www.gorillawalker.com/global-memoryscapes-contesting-remembrance-in-a-transnational-age-albma-rhetoric.pdf
    • http://www.gorillawalker.com/mixture-formation-in-internal-combustion-engines-heat-and-mass-transfer.pdf
    • http://www.gorillawalker.com/medical-malpractice-law-handbook-new-with-the-latest-amendments-of.pdf
    • http://www.gorillawalker.com/lust-in-the-jungle-a-bimbo-story-kindle-edition.pdf
    • http://www.gorillawalker.com/cmos-and-beyond-logic-switches-for-terascale-integrated-circuits.pdf
    • http://www.gorillawalker.com/the-little-black-classics-reckoning.pdf
    • http://www.gorillawalker.com/the-prostate-solution-kindle-edition.pdf
    • http://www.gorillawalker.com/cb-5-with-coursemate-printed-access-card-new-engaging-titles.pdf
    • http://www.gorillawalker.com/the-reappearance-of-the-christ.pdf
    • http://www.gorillawalker.com/betting-on-famine-why-the-world-still-goes-hungry-hardcover.pdf
    • http://www.gorillawalker.com/spring-fling.pdf
    • http://www.gorillawalker.com/my-heart-will-go-on-and-other-movie-hits.pdf
    • http://www.gorillawalker.com/egyptian-magic-the-quest-for-thoth-s-book-of-secrets.pdf
    • http://www.gorillawalker.com/the-law-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/the-king-s-english-strategies-of-translation-in-the-old.pdf
    • http://www.gorillawalker.com/weightlifting-strength-building-an-integrated-life-of-fitness.pdf
    • http://www.gorillawalker.com/the-case-for-atheism-there-isn-t-one.pdf
    • http://www.gorillawalker.com/marc-blitzstein-his-life-his-work-his-world.pdf
    • http://www.gorillawalker.com/the-art-of-wireless-sensor-networks-volume-1-fundamentals-signals.pdf
    • http://www.gorillawalker.com/famous-movie-dance-stars-paper-dolls-dover-celebrity-paper-dolls.pdf
    • http://www.gorillawalker.com/untersuchungen-zur-ikonographie-der-darstellungen-der-meroitischen-konigsfamilie-und-zu.pdf
    • http://www.gorillawalker.com/age-gender-may-flag-risk-for-serious-infections-in-diabetics.pdf
    • http://www.gorillawalker.com/baraja-espanola-superfacil-con-barajas-spanish-edition.pdf
    • http://www.gorilla
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.