Malicious PDF — malware analysis report

Static analysis result for SHA-256 63ce14cfd2ddb45e…

MALICIOUS

PDF

32.7 KB Created: 2020-02-20 05:09:00 +03:00 Authoring application: - (via Acrobat Distiller 15.0 (Windows))
MD5: bdac77c4ab4e37860032d11e55dceb21 SHA-1: 60bac77b1492f52329b14fc4cd8844a80a003940 SHA-256: 63ce14cfd2ddb45ec5acece39e5bdb56eb2e69f328bcba25c8bf900287e972b1
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This is indicative of a link farm or SEO manipulation tactic. While no scripts were explicitly extracted, the heuristic 'PDF_SEO_LINK_FARM' and the sheer volume of external links suggest a malicious intent to drive traffic or distribute content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8313

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-art-of-dancing-historically-illustrated-to-which-is-added.pdf
    • http://www.gorillawalker.com/divine-fire-eight-contemporary-plays-inspired-by-the-greeks-paperback.pdf
    • http://www.gorillawalker.com/500-smoothies-juices-the-only-smoothie-juices-compendium-you-ll.pdf
    • http://www.gorillawalker.com/just-another-sunrise-poems-to-the-sun-kindle-edition.pdf
    • http://www.gorillawalker.com/james-whale-a-biography-or-the-would-be-gentleman-lesbian.pdf
    • http://www.gorillawalker.com/reef-fishes-of-new-guinea-a-field-guide-for-divers.pdf
    • http://www.gorillawalker.com/the-good-doctor-what-patients-want.pdf
    • http://www.gorillawalker.com/the-social-entrepreneur-making-communities-work.pdf
    • http://www.gorillawalker.com/championships-1989-wimbledon-official-annual.pdf
    • http://www.gorillawalker.com/bone-map-poems-national-poetry-series.pdf
    • http://www.gorillawalker.com/the-alpha-arizona-divorce-or-legal-separation-kit.pdf
    • http://www.gorillawalker.com/improvisation-i-for-solo-alto-saxophone.pdf
    • http://www.gorillawalker.com/how-to-succeed-at-interviews-includes-over-200-interview-questions.pdf
    • http://www.gorillawalker.com/eye-of-the-lotus-psychology-of-the-chakras.pdf
    • http://www.gorillawalker.com/british-regional-food-in-search-of-the-best-british-food.pdf
    • http://www.gorillawalker.com/the-other-side-of-the-tiber-reflections-on-time-in.pdf
    • http://www.gorillawalker.com/mary-higgins-clark-life-and-letters.pdf
    • http://www.gorillawalker.com/viking-stepbrother-master-1-viking-stepbrother-series.pdf
    • http://www.gorillawalker.com/truth-and-money-fresh-thinking-on-money-management-and-personal.pdf
    • http://www.gorillawalker.com/pakistan-countries-cultures.pdf
    • http://www.gorillawalker.com/roger-rigorth.pdf
    • http://www.gorillawalker.com/the-rob-roy-on-the-jordan.pdf
    • http://www.gorillawalker.com/invertebrate-cell-system-applications-volume-i.pdf
    • http://www.gorillawalker.com/large-print-sudoku-beginner-easy-to-read-large-grid-sudoku.pdf
    • http://www.gorillawalker.com/explore-britain-s-national-parks-aa-explore-britain-guides.pdf
    • http://www.gorillawalker.com/cognitive-behavioural-approaches-to-the-prevention-of-suicide-behaviour-in.pdf
    • http://www.gorillawalker.com/top-30-most-popular-most-recommended-and-most-demanded-mouth.pdf
    • http://www.gorillawalker.com/rosemaling-the-beautiful-norwegian-art.pdf
    • http://www.gorillawalker.com/a-soldier-of-megiddo-the-genehunter-series-book-4-unabridged.pdf
    • http://www.gorillawalker.com/fidic-conditions-of-contract-for-construction-first-edition-red.pdf
    • http://www.gorillawalker.com/the-addams-family-musical-choral-highlights-mark-brymer-satb-satb.pdf
    • http://www.gorillawalker.com/getting-stoned-with-savages-a-trip-through-the-islands-of.pdf
    • http://www.gorillawalker.com/from-those-wonderful-folks-who-gave-you-pearl-harbour-unabridged.pdf
    • http://www.gorillawalker.com/phenomenology-explained-from-experience-to-insight-ideas-explained.pdf
    • http://www.gorillawalker.com/the-power-of-music-pioneering-discoveries-in-the-new-science.pdf
    • http://www.gorillawalker.com/sleep-encyclopedia-of-health.pdf
    • http://www.gorillawalker.com/clinical-symposia-volume-29-number-5-1977.pdf
    • http://www.gorillawalker.com/proclus-on-the-existence-of-evils-ancient-commentators-on-aristotle.pdf
    • http://www.gorillawalker.com/icd-10-cm-for-hospitals-the-complete-official-draft-code.pdf
    • http://www.gorillawalker.com/hiking-idaho-s-seven-devils.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.