Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f8385d45800d6c3…

MALICIOUS

PDF

41.5 KB Created: 2018-12-03 17:10:56 +03:00 Authoring application: Microsoft Word (via Acrobat PDFWriter 4.0 para Windows)
MD5: 3148a3ce6d7f780154d75a91b237c453 SHA-1: 916771b658b296fa69edc965699c2e6c270b756c SHA-256: 5f8385d45800d6c3134896e43ee1d1a90d7e9bf436150821bd100eaef1327cf5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute additional malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/domina-lady-sas-exchange-of-slaves.pdf
    • http://www.gorillawalker.com/mind-bending-puzzles-calendar-2003.pdf
    • http://www.gorillawalker.com/field-guide-to-lidar-spie-field-guide-fg36-field-guide.pdf
    • http://www.gorillawalker.com/taste-of-colombia.pdf
    • http://www.gorillawalker.com/voyages-of-the-damn-foole.pdf
    • http://www.gorillawalker.com/multivariable-mathematics-with-maple-linear-algebra-vector-calculus-and-differential.pdf
    • http://www.gorillawalker.com/the-military-balance-1990-1991-the-international-institute-for-strategic.pdf
    • http://www.gorillawalker.com/lonely-planet-hong-kong-city-map.pdf
    • http://www.gorillawalker.com/chewy-louie.pdf
    • http://www.gorillawalker.com/sonata-no-1-in-g-minor-kalmus-edition.pdf
    • http://www.gorillawalker.com/critical-thinking-and-communication-the-use-of-reason-in-argument.pdf
    • http://www.gorillawalker.com/world-book-encyclopedia-2005-complete-set.pdf
    • http://www.gorillawalker.com/holt-mcdougal-geometry-are-you-ready-intervention-and-enrichment-workbook.pdf
    • http://www.gorillawalker.com/cool-trucks-cool-kits.pdf
    • http://www.gorillawalker.com/v-k-dmitriev-economic-essays-on-value-competition-and-utility.pdf
    • http://www.gorillawalker.com/the-presbyterian-heritage-daily-devotional-selections-from-the-confessions-for.pdf
    • http://www.gorillawalker.com/spiritually-able-a-parent-146-s-guide-to-teaching-the.pdf
    • http://www.gorillawalker.com/duocarns-the-arrival.pdf
    • http://www.gorillawalker.com/at-issue-in-history-bill-of-rights-hardcover-edition.pdf
    • http://www.gorillawalker.com/tears-of-the-vampire-immortal-destiny-volume-4.pdf
    • http://www.gorillawalker.com/white-cloud-temple-in-beijing-a-travel-guide-and-tour.pdf
    • http://www.gorillawalker.com/the-book-of-awakening-thorndike-press-large-print-inspirational.pdf
    • http://www.gorillawalker.com/seth-greyson-the-coincidence-series-book-8.pdf
    • http://www.gorillawalker.com/the-world-trade-organization-a-beginner-s-guide-beginner-s.pdf
    • http://www.gorillawalker.com/the-incredible-tale-of-frost-the-frost-series-book-1.pdf
    • http://www.gorillawalker.com/mensa-activity-pack-for-kids.pdf
    • http://www.gorillawalker.com/can-she-bake-a-cherry-pie-emaline-banister-mysteries-book.pdf
    • http://www.gorillawalker.com/operator-s-and-organizational-maintenance-manual-telescope-observation-m49-w.pdf
    • http://www.gorillawalker.com/the-stock-market-cash-flow-four-pillars-of-investing-for.pdf
    • http://www.gorillawalker.com/bach-146-s-well-tempered-clavier-an-exploration-of-the.pdf
    • http://www.gorillawalker.com/debating-slavery-economy-and-society-in-the-antebellum-american-south.pdf
    • http://www.gorillawalker.com/transformation-electromagnetics-and-metamaterials-fundamental-principles-and-applications.pdf
    • http://www.gorillawalker.com/election-day-weekend-voting.pdf
    • http://www.gorillawalker.com/day-hiker-s-guide-to-southern-california-vol-2.pdf
    • http://www.gorillawalker.com/in-mysterious-ways-the-death-and-life-of-a-parish.pdf
    • http://www.gorillawalker.com/the-sufi-courtyard-dargahs-of-delhi.pdf
    • http://www.gorillawalker.com/scandinavian-graphic-design.pdf
    • http://www.gorillawalker.com/teaching-human-beings.pdf
    • http://www.gorillawalker.com/pricing-and-billing-for-content.pdf
    • http://www.gorillawalker.com/the-bible-with-sources-revealed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.