Malicious PDF — malware analysis report

Static analysis result for SHA-256 6291340154669461…

MALICIOUS

PDF

45.2 KB Created: 2018-12-14 20:23:31 +03:00 Authoring application: - (via iText 2.1.7 by 1T3XT)
MD5: bb9cedeea80da80b14d091d0d76e46f6 SHA-1: 82e63303a55ce6fafb4e1c2fa47018758191781d SHA-256: 6291340154669461432538d7c17de7dea1d101aa1f6fa0f0ad1f953cce69ba24
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be to direct users to a vast collection of PDF documents hosted on the `gorillawalker.com` domain, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8173

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/stone-cold-lover-gargoyles-series-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/you-rule-take-charge-of-your-health-and-life-a.pdf
    • http://www.gorillawalker.com/the-angel-of-bethesda-an-essay-upon-the-common-maladies.pdf
    • http://www.gorillawalker.com/masonry-construction.pdf
    • http://www.gorillawalker.com/le-nouveau-testament-bilingue-fran-ais-allemand-french-edition.pdf
    • http://www.gorillawalker.com/secured-transactions.pdf
    • http://www.gorillawalker.com/windows-on-the-world-complete-wine-course-2004-edition-a.pdf
    • http://www.gorillawalker.com/ghosts-and-legends-of-lake-erie-s-north-coast-haunted.pdf
    • http://www.gorillawalker.com/echoviruses.pdf
    • http://www.gorillawalker.com/solution-key-algebra-and-trigonometry-structure-and-method-book-2.pdf
    • http://www.gorillawalker.com/breaking-bad-30-ways-to-cook-chicken-a-cookbook.pdf
    • http://www.gorillawalker.com/lesotho-southbound-travel-guides-kindle-edition.pdf
    • http://www.gorillawalker.com/flip-flop-girl.pdf
    • http://www.gorillawalker.com/el-gran-libro-de-las-100-preguntas-sobre-los-reptiles.pdf
    • http://www.gorillawalker.com/new-worlds-for-all-indians-europeans-and-the-remaking-of.pdf
    • http://www.gorillawalker.com/the-bald-eagle-primary-sources-of-american-symbols.pdf
    • http://www.gorillawalker.com/how-to-trade-a-currency-fund-the-step-by-step.pdf
    • http://www.gorillawalker.com/artifacts-from-ancient-rome-daily-life-through-artifacts.pdf
    • http://www.gorillawalker.com/ftce-english-6-12-teacher-certification-test-prep-study-guide.pdf
    • http://www.gorillawalker.com/address-of-the-honorable-charles-b-penrose-speaker-of-the.pdf
    • http://www.gorillawalker.com/the-faces-of-single-adult-ministries.pdf
    • http://www.gorillawalker.com/the-me-i-want-to-be-participant-s-guide-becoming.pdf
    • http://www.gorillawalker.com/living-in-norway-a-practical-guide.pdf
    • http://www.gorillawalker.com/contract-law-applies-and-the-trial-practice-paperback.pdf
    • http://www.gorillawalker.com/rendering-in-sketchup-from-modeling-to-presentation-for-architecture-landscape.pdf
    • http://www.gorillawalker.com/i-m-going-to-read-level-1-easter-has-eggs.pdf
    • http://www.gorillawalker.com/the-moth-and-the-crow-books-of-belshalara-volume-2.pdf
    • http://www.gorillawalker.com/song-for-salamander.pdf
    • http://www.gorillawalker.com/a-survey-of-matrix-theory-and-matrix-inequalities-dover-books.pdf
    • http://www.gorillawalker.com/coloring-books-for-adults-flowers-pattern-coloring-pages-floral-design.pdf
    • http://www.gorillawalker.com/cows-in-the-kitchen.pdf
    • http://www.gorillawalker.com/rapid-isothermal-processing-proceedings-of-spie.pdf
    • http://www.gorillawalker.com/dise-o-e-historia-tiempo-lugar-y-discurso-spanish-edition.pdf
    • http://www.gorillawalker.com/re-playing-shakespeare-in-asia.pdf
    • http://www.gorillawalker.com/the-plant-cycle-nature-cycles.pdf
    • http://www.gorillawalker.com/flirting-with-frogs-because-sometimes-your-prince-takes-longer-than.pdf
    • http://www.gorillawalker.com/the-architecture-of-libya-libya-s-traditional-berber-and-roman.pdf
    • http://www.gorillawalker.com/100-things-south-carolina-fans-should-know-do-before-they.pdf
    • http://www.gorillawalker.com/a-bicycle-journey-to-the-bottom-of-the-americas-being.pdf
    • http://www.gorillawalker.com/wok-and-stir-fry-cooking.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.