Malicious PDF — malware analysis report

Static analysis result for SHA-256 52181a13691a29a5…

MALICIOUS

PDF

33.2 KB Created: 2019-12-13 19:49:57 +03:00 Authoring application: ABBYY FineReader (via -)
MD5: 167f43e5b9678729721b8e6acb47808a SHA-1: d1a629d62e3569f44529fd932954001dd13fcf86 SHA-256: 52181a13691a29a5bf0afc26154728728af1c9912982c4af849678546166563e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content indirectly. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a link farm hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/teaching-hair-coloring-milady.pdf
    • http://www.gorillawalker.com/crystal-cove-underwater-park-newport-beach-california-map-kelp-forest.pdf
    • http://www.gorillawalker.com/autocourse-indy-car-1993-94.pdf
    • http://www.gorillawalker.com/shoot-macro-professional-macrophotography-techniques-for-exceptional-studio-images.pdf
    • http://www.gorillawalker.com/secrets-to-progressive-surfing.pdf
    • http://www.gorillawalker.com/yorkshire-villages-classic-country-companions.pdf
    • http://www.gorillawalker.com/the-barstow-printer-a-personal-name-and-subject-index-to.pdf
    • http://www.gorillawalker.com/the-garden-lover-s-guide-to-the-south.pdf
    • http://www.gorillawalker.com/short-lessons-in-world-history.pdf
    • http://www.gorillawalker.com/butte-an-unfinished-story.pdf
    • http://www.gorillawalker.com/the-boston-tea-party-let-freedom-ring.pdf
    • http://www.gorillawalker.com/a-courier-in-new-mexico.pdf
    • http://www.gorillawalker.com/daughters-of-the-bear-an-anthology-of-korean-women-s.pdf
    • http://www.gorillawalker.com/island-of-saints-a-story-of-the-one-principle-that.pdf
    • http://www.gorillawalker.com/poetry-underpinning-power-vergil-s-aeneid-the-epic-for-emperor.pdf
    • http://www.gorillawalker.com/growth-and-defence-in-plants-resource-allocation-at-multiple-scales.pdf
    • http://www.gorillawalker.com/boundary-waters-quetico-2013.pdf
    • http://www.gorillawalker.com/sixteenth-international-seaweed-symposium-proceedings-of-the-sixteenth-international-seaweed.pdf
    • http://www.gorillawalker.com/puppy-training-guide-4th-edition-the-ultimate-handbook-to-train.pdf
    • http://www.gorillawalker.com/the-bhagavad-gita-the-sacred-song.pdf
    • http://www.gorillawalker.com/design-optimization-of-gas-generator-hybrid-propulsion-boosters-sudoc-nas.pdf
    • http://www.gorillawalker.com/the-latino-threat-constructing-immigrants-citizens-and-the-nation.pdf
    • http://www.gorillawalker.com/experimental-cognitive-psychology-and-its-applications-decade-of-behavior.pdf
    • http://www.gorillawalker.com/you-are-what-you-eat.pdf
    • http://www.gorillawalker.com/contemporary-diagnosis-and-management-of-dyspepsia-and-gerd.pdf
    • http://www.gorillawalker.com/data-center-handbook.pdf
    • http://www.gorillawalker.com/follow-this-path-how-the-world-s-greatest-organizations-drive.pdf
    • http://www.gorillawalker.com/the-norton-book-of-classical-literature.pdf
    • http://www.gorillawalker.com/textu.pdf
    • http://www.gorillawalker.com/sage-dictionary-of-criminology.pdf
    • http://www.gorillawalker.com/sankara-paperback.pdf
    • http://www.gorillawalker.com/a-synopsis-of-american-history-since-the-civil-war.pdf
    • http://www.gorillawalker.com/prophet-of-decline-spengler-on-world-history-and-politics-political.pdf
    • http://www.gorillawalker.com/the-thermodynamics-and-gas-dynamics-of-internal-combustion-engines-volume.pdf
    • http://www.gorillawalker.com/south-sea-idyls-primary-source-edition.pdf
    • http://www.gorillawalker.com/global-issues-in-environmental-law.pdf
    • http://www.gorillawalker.com/kingship-the-almost-complete-story-kindle-edition.pdf
    • http://www.gorillawalker.com/mastering-italic-calligraphy-the-scribner-hobbies-library.pdf
    • http://www.gorillawalker.com/track-design-the-complete-book-of-layout-design.pdf
    • http://www.gorillawalker.com/g-chocolate-cookbook.pdf
    • http://www.gorillawalker.com/dau
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.