Malicious PDF — malware analysis report

Static analysis result for SHA-256 643e7d2131cece24…

MALICIOUS

PDF

42.2 KB Created: 2018-12-15 08:11:00 +03:00 Authoring application: TeX (via pdfTeX-0.14h)
MD5: 99bb9207066c24a6d77786784f159e7d SHA-1: 2a8e7f6e2a4291373497c922cfe66b64ab2fded2 SHA-256: 643e7d2131cece2474fb579e6874afab5882298cadb6e8cd3b4f6ff7ea9c2e0a
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files on the domain www.gorillawalker.com. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content disguised as legitimate documents. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/manuale-tecnico-del-pilates.pdf
    • http://www.gorillawalker.com/how-to-file-for-divorce-in-florida-9e.pdf
    • http://www.gorillawalker.com/the-lights-of-xanadu-an-oliver-marshall-serial-oliver-marshall.pdf
    • http://www.gorillawalker.com/parlons-et-ecrivons.pdf
    • http://www.gorillawalker.com/more-simply-pilates-book-dvd.pdf
    • http://www.gorillawalker.com/no-word-for-time-the-way-of-the-algonquin-people.pdf
    • http://www.gorillawalker.com/the-state-of-coral-reef-ecosystems-of-the-united-states.pdf
    • http://www.gorillawalker.com/health-care-disparities-and-diversity-in-emergency-medicine-chapter-217.pdf
    • http://www.gorillawalker.com/nuevas-l.pdf
    • http://www.gorillawalker.com/child-soldier-when-boys-and-girls-are-used-in-war.pdf
    • http://www.gorillawalker.com/gcse-ict-total-revision.pdf
    • http://www.gorillawalker.com/winston-churchill-s-war-leadership.pdf
    • http://www.gorillawalker.com/place-names-in-classical-mythology-greece.pdf
    • http://www.gorillawalker.com/contagious-courage-a-30-day-journey-to-overcoming-stress-and.pdf
    • http://www.gorillawalker.com/honor-under-siege.pdf
    • http://www.gorillawalker.com/kinky-shades-of-black-women-in-charge-erotic-short-stories.pdf
    • http://www.gorillawalker.com/aerodynamic-effect-of-strakes-on-two-dimensional-tail-boom-models.pdf
    • http://www.gorillawalker.com/thermoelectricity-in-metals-and-alloys.pdf
    • http://www.gorillawalker.com/first-course-in-digital-electronics-a.pdf
    • http://www.gorillawalker.com/positive-african-american-plays-for-children-book-3.pdf
    • http://www.gorillawalker.com/christmas-gifts-of-good-taste.pdf
    • http://www.gorillawalker.com/shrimad-rajchandra-saga-de-la-espiritualidad-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/the-little-book-of-the-sea.pdf
    • http://www.gorillawalker.com/thinking-critically-to-solve-problems-values-and-finite-mathematical-thinking.pdf
    • http://www.gorillawalker.com/howl-of-the-werewolf-fighting-fantasy.pdf
    • http://www.gorillawalker.com/the-protector-s-bond-christian-romance-sacred-bond-guardians-prequel.pdf
    • http://www.gorillawalker.com/the-letter-cc-food-letter-books.pdf
    • http://www.gorillawalker.com/ascendentes-en-astrologia-ascendants-in-astrology-spanish-edition.pdf
    • http://www.gorillawalker.com/common-sense-in-the-household-a-manual-of-practical-housewifery.pdf
    • http://www.gorillawalker.com/the-analogical-imagination-christian-theology-and-the-culture-of-pluralism.pdf
    • http://www.gorillawalker.com/serenade-franz-schubert-ukelele-1935-sheet-music-sheet-music-202.pdf
    • http://www.gorillawalker.com/manual-of-tropical-medicine-by-aldo-castellani-and-albert-j.pdf
    • http://www.gorillawalker.com/paul-cesar-helleu.pdf
    • http://www.gorillawalker.com/5-steps-to-the-hollywood-a-list-smile-how-the.pdf
    • http://www.gorillawalker.com/bare-the-naked-truth-about-stripping-live-girls.pdf
    • http://www.gorillawalker.com/california-rules-of-court-state-and-federal-1999-revised-edition.pdf
    • http://www.gorillawalker.com/openstack-networking-cookbook.pdf
    • http://www.gorillawalker.com/the-illustrated-timeline-of-military-history-history-timelines.pdf
    • http://www.gorillawalker.com/audio-visual-coverage-of-courts-a-comparative-analysis.pdf
    • http://www.gorillawalker.com/global-financial-stability-report-financial-market-turbulence-causes-consequences-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.