Malicious PDF — malware analysis report

Static analysis result for SHA-256 5245b9bb4bd3be42…

MALICIOUS

PDF

44.3 KB Created: 2018-11-23 08:08:35 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 8.0.0 (Windows))
MD5: bb1b462cac714ce80cfc93481e92c64c SHA-1: e63e6ad802ccdb272877fea5aa964764c83b370b SHA-256: 5245b9bb4bd3be42312b4ba9dc403e819c66f6176efd50819814a64b581b4e23
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, specifically 32, pointing to various PDF documents on the domain 'www.gorillawalker.com'. This behavior is indicative of a link farm or a method to distribute malicious content disguised as legitimate documents. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/grandmaster-repertoire-13-the-open-spanish.pdf
    • http://www.gorillawalker.com/alphabet-i-like-to-learn-the-abcs.pdf
    • http://www.gorillawalker.com/port-moresby-mixed-doubles-stories-of-expatriates-in-papua-new.pdf
    • http://www.gorillawalker.com/the-times-law-reports-bound-v-2009.pdf
    • http://www.gorillawalker.com/1001-fundamental-general-chemistry-set-with-resealable-bag-hgs-polyhedron.pdf
    • http://www.gorillawalker.com/watercolor-depth-and-realism.pdf
    • http://www.gorillawalker.com/the-scarlet-letterman-the-bard-academy.pdf
    • http://www.gorillawalker.com/bipolar-disorder-survival-guide-how-to-manage-your-bipolar-symptoms.pdf
    • http://www.gorillawalker.com/pioneer-in-guatemala-the-personal-history-of-john-forres-o.pdf
    • http://www.gorillawalker.com/rechtliche-qualit-tsvorgaben-in-der-station-ren-altenpflege.pdf
    • http://www.gorillawalker.com/georgia-off-the-beaten-path-6th-a-guide-to-unique.pdf
    • http://www.gorillawalker.com/physical-ultrasonics-of-composites.pdf
    • http://www.gorillawalker.com/current-bibliographies-in-medicine-volume-65.pdf
    • http://www.gorillawalker.com/hors-d-oeuvre-appetizers-original-title-hors-d-oeuvre-and.pdf
    • http://www.gorillawalker.com/the-lights-of-home.pdf
    • http://www.gorillawalker.com/farewell-to-manzanar-and-related-readings-literature-connections-sourcebook.pdf
    • http://www.gorillawalker.com/zur-ultrastruktur-des-organon-vasculosum-laminae-terminalis-der-ratte-mit.pdf
    • http://www.gorillawalker.com/my-alice-in-wonderland-notebook-little-activity-books.pdf
    • http://www.gorillawalker.com/167-whiskey-recipes-the-big-whiskey-cookbook-with-almost-every.pdf
    • http://www.gorillawalker.com/glass-containers-in-thailand-download-pdf-digital.pdf
    • http://www.gorillawalker.com/addison-wesley-algebra-and-trigonometry-teacher-s-edition.pdf
    • http://www.gorillawalker.com/data-quality-advances-in-database-systems.pdf
    • http://www.gorillawalker.com/ireland-offshore-tax-guide.pdf
    • http://www.gorillawalker.com/fantasy-on-rigoletto-based-on-the-opera-by-giuseppe-verdi.pdf
    • http://www.gorillawalker.com/the-red-volcanoes-face-to-face-with-the-mountains-of.pdf
    • http://www.gorillawalker.com/the-forex-trading-millionaire-the-craziest-story-you-have-ever.pdf
    • http://www.gorillawalker.com/the-intelligence-of-tradition-in-rajput-court-painting.pdf
    • http://www.gorillawalker.com/basic-fracture-mechanics-including-an-introduction-to-fatigue-butterworths-basic.pdf
    • http://www.gorillawalker.com/westward-weird.pdf
    • http://www.gorillawalker.com/mikrokosmos-volume-1-pink-piano-solo-english-french-german-hungarian.pdf
    • http://www.gorillawalker.com/mattinata-arrangement-for-tenor-and-orchestra-e-major-full-score.pdf
    • http://www.gorillawalker.com/rachmaninoff-vocalise-opus-34-no-14-for-clarinet-and-piano.pdf
    • http://www.gorillawalker.com/the-song-of-names.pdf
    • http://www.gorillawalker.com/milton-a-poem.pdf
    • http://www.gorillawalker.com/natural-vitamin-water-recipes-healthy-refreshing-vitamin-water-recipes-you.pdf
    • http://www.gorillawalker.com/aromatherapy-and-essential-oils-a-beginners-guide-to-better-health.pdf
    • http://www.gorillawalker.com/organizational-behavior-in-education-leadership-and-school-reform-10th-edition.pdf
    • http://www.gorillawalker.com/how-to-take-charge-of-your-life-the-user-s.pdf
    • http://www.gorillawalker.com/keydata-ec-atlas-bbc-dfs.pdf
    • http://www.gorillawalker.com/high-performance-android-apps-improve-ratings-with-speed-optimizations-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.