Malicious PDF — malware analysis report

Static analysis result for SHA-256 5553803bc1db612e…

MALICIOUS

PDF

45.6 KB Created: 2018-12-15 09:16:38 +03:00 Authoring application: TopLeaf 7.6.056 (via iText 2.1.7 by 1T3XT)
MD5: bc116f0ae320f4a003525b4b08aacd4c SHA-1: f4c23899e2d7846ee52e205c0e0bb5df0d7a6992 SHA-256: 5553803bc1db612e3f5f0f822e2804f1883b28fec029f59ea0d2171fb9f97058
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or redirect users to potentially harmful content hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/broom-corn-and-brooms-a-treatise-on-raising-broom-corn.pdf
    • http://www.gorillawalker.com/inner-perception-outer-perfection-a-guide-to-eliminating-bullies-recognizing.pdf
    • http://www.gorillawalker.com/emotions-at-work-normative-control-organizations-and-culture-in-japan.pdf
    • http://www.gorillawalker.com/shakespeare-s-living-art-princeton-legacy-library.pdf
    • http://www.gorillawalker.com/danse-macabre-close-encounters-with-the-reaper.pdf
    • http://www.gorillawalker.com/born-to-organize-everything-you-need-to-know-about-a.pdf
    • http://www.gorillawalker.com/primer-of-biostatistics-seventh-edition-primer-of-biostatistics-glantz-paperback.pdf
    • http://www.gorillawalker.com/the-poisonous-cloud-chemical-warfare-in-the-first-world-war.pdf
    • http://www.gorillawalker.com/papa-francisco-esta-econom-a-mata-mundo-y-cristianismo-spanish.pdf
    • http://www.gorillawalker.com/u-s-army-special-forces-power.pdf
    • http://www.gorillawalker.com/programming-games-with-visual-c-express.pdf
    • http://www.gorillawalker.com/helping-teenagers-with-anger-low-self-esteem.pdf
    • http://www.gorillawalker.com/talking-dirty-slang-expletives-and-curses-from-around-the-world.pdf
    • http://www.gorillawalker.com/in-fitting-memory-the-art-and-politics-of-holocaust-memorials.pdf
    • http://www.gorillawalker.com/gravitational-collapse-and-spacetime-singularities-cambridge-monographs-on-mathematical-physics.pdf
    • http://www.gorillawalker.com/i-lombardi-alla-prima-crociata-act-iii-terzetto-qui-posa.pdf
    • http://www.gorillawalker.com/white-farmer-s-black-neighbor-cuckold-shame-book-4-kindle.pdf
    • http://www.gorillawalker.com/introduction-to-general-topology-holden-day-series-in-mathematics.pdf
    • http://www.gorillawalker.com/the-missing-mitt-hardy-boys-the-secret-files.pdf
    • http://www.gorillawalker.com/simple-old-fashioned-baking-the-best-recipes-from-grandma-s.pdf
    • http://www.gorillawalker.com/city-of-vero-beach-v-rittenoure-inv-co-u-s.pdf
    • http://www.gorillawalker.com/beyond-pesticides-biological-approaches-to-pest-management-in-california.pdf
    • http://www.gorillawalker.com/personal-reminiscences-of-general-robert-e-lee.pdf
    • http://www.gorillawalker.com/guards-webster-s-specialty-crossword-puzzles-volume-2-the-enthusiast.pdf
    • http://www.gorillawalker.com/el-economista-camuflado-the-undercover-economist-spanish-edition.pdf
    • http://www.gorillawalker.com/using-netware-3-12-using-que.pdf
    • http://www.gorillawalker.com/film-in-five-seconds.pdf
    • http://www.gorillawalker.com/jorge-teillier-poet-of-the-hearth.pdf
    • http://www.gorillawalker.com/constitutional-law-for-dummies.pdf
    • http://www.gorillawalker.com/introduction-to-no-knead-turbo-bread-ready-to-bake-in.pdf
    • http://www.gorillawalker.com/warlpiri-women-s-voices-our-lives-our-history-oral-history.pdf
    • http://www.gorillawalker.com/kick-ass-2.pdf
    • http://www.gorillawalker.com/by-love-reclaimed-jean-harlow-returns-to-clear-her-husband.pdf
    • http://www.gorillawalker.com/just-after-sunset-short-stories.pdf
    • http://www.gorillawalker.com/reading-the-letters-of-pliny-the-younger-an-introduction.pdf
    • http://www.gorillawalker.com/turn-back-time-the-high-street.pdf
    • http://www.gorillawalker.com/seeking-whom-he-may-devour-chief-inspector-adamsberg-investigates-thorndike.pdf
    • http://www.gorillawalker.com/stones-in-the-road-photographs-of-peru.pdf
    • http://www.gorillawalker.com/hotel-arcadia.pdf
    • http://www.gorillawalker.com/the-high-valley.pdf
    • http://www.gorillawalk
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.