Malicious PDF — malware analysis report

Static analysis result for SHA-256 59c612d09c5dc257…

MALICIOUS

PDF

41.5 KB Created: 2018-11-30 20:09:02 +03:00 Authoring application: - (via Acrobat PDFWriter 3.02 for Windows NT)
MD5: 12d3831a5f3d0af618156c0e47cfe6dd SHA-1: af2f15f0f90ce3cb025ff6c391092d47361f7c56 SHA-256: 59c612d09c5dc257ea4096cf15d825e17d8e6381d251e7cab9d6dd915ce668d2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be SEO manipulation or directing users to a large collection of documents hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/who-s-buying-entertainment-who-s-buying-series.pdf
    • http://www.gorillawalker.com/essentials-of-organizational-behavior-12th-edition.pdf
    • http://www.gorillawalker.com/cavendon-hall.pdf
    • http://www.gorillawalker.com/ecce-homo-large-print-edition.pdf
    • http://www.gorillawalker.com/the-journey-of-jesus-as-told-by-the-narrator-of.pdf
    • http://www.gorillawalker.com/built-for-show-four-body-changing-workouts-for-building-muscle.pdf
    • http://www.gorillawalker.com/sonata-in-g-k-283-signature-series-abrsm.pdf
    • http://www.gorillawalker.com/save-this-christmas-turtleback-school-library-binding-edition-lego-city.pdf
    • http://www.gorillawalker.com/revolt-of-the-netherlands-1555-1609.pdf
    • http://www.gorillawalker.com/handel-s-messiah-the-story-behind-the-greatest-music-ever.pdf
    • http://www.gorillawalker.com/in-peace-prepared-innovation-and-adaptation-in-canada-s-cold.pdf
    • http://www.gorillawalker.com/the-retail-management-formula-a-navigational-guide-to-consistently-effective.pdf
    • http://www.gorillawalker.com/once-minutos-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/sleuthing-the-alamo-davy-crockett-s-last-stand-and-other.pdf
    • http://www.gorillawalker.com/trombone-concerto-edited-by-john-mcginn.pdf
    • http://www.gorillawalker.com/glencoe-geometry-teachers-wraparound-edition.pdf
    • http://www.gorillawalker.com/perspectives-on-political-parties-classic-readings.pdf
    • http://www.gorillawalker.com/nothing-at-all-fesler-lampert-minnesota-heritage.pdf
    • http://www.gorillawalker.com/fashion-the-key-concepts.pdf
    • http://www.gorillawalker.com/the-emperor-wears-no-clothes-hemp-and-the-marijuana-conspiracy.pdf
    • http://www.gorillawalker.com/budo-secrets-teachings-of-the-martial-arts-masters.pdf
    • http://www.gorillawalker.com/can-faith-heal-the-invalid-and-other-articles-little-blue.pdf
    • http://www.gorillawalker.com/gibbs-measures-and-phase-transitions-de-gruyter-studies-in-mathematics.pdf
    • http://www.gorillawalker.com/buchholz-text-and-lippincott-tutorials-and-case-studies-package.pdf
    • http://www.gorillawalker.com/musichound-world-the-essential-album-guide-musichound-essential-album-guides.pdf
    • http://www.gorillawalker.com/operation-montauk-kindle-edition.pdf
    • http://www.gorillawalker.com/bread-bread-rolls-coffee-cakes-quick-breads-biscuits-muffins-scones.pdf
    • http://www.gorillawalker.com/acoustical-sensing-and-imaging.pdf
    • http://www.gorillawalker.com/the-graphic-canon-of-children-s-literature-the-world-s.pdf
    • http://www.gorillawalker.com/animals-and-society-the-humanity-of-animal-rights.pdf
    • http://www.gorillawalker.com/the-house-of-power-atherton-book-1-house-of-power.pdf
    • http://www.gorillawalker.com/instalacion-de-paneles-solares-termicos-spanish-edition.pdf
    • http://www.gorillawalker.com/first-bible-stories.pdf
    • http://www.gorillawalker.com/quantile-regression-econometric-society-monographs-kindle-edition.pdf
    • http://www.gorillawalker.com/coldplay-parachutes-tab.pdf
    • http://www.gorillawalker.com/safari-for-gold.pdf
    • http://www.gorillawalker.com/notes-on-the-entire-bible-the-book-of-deuteronomy-john.pdf
    • http://www.gorillawalker.com/ringed-by-the-flat-horizon-score.pdf
    • http://www.gorillawalker.com/sing-learn-italian-with-professor-toto-italian-edition.pdf
    • http://www.gorillawalker.com/introducci-n-al-lenguaje-de-programaci-n-c-spanish-edition.pdf
    • http://www.gorillawalker.com/the-journey-of-jesus-as-told-by-the-na
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.