Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a6e6af62ec0b02d…

MALICIOUS

PDF

33.2 KB Created: 2019-05-24 00:41:39 +03:00 Authoring application: PDFpen First seen: 2021-06-28
MD5: 3d904cd2ef1eb48ea20ea934f31ac4b0 SHA-1: f8d28381ce370aae525d4cf916caf349cd806fe8 SHA-256: 6a6e6af62ec0b02deb1b3f1fe5aefcaf3e3db24e5300632cbeecc1e17cd6c492
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. These links are all hosted on the domain 'gorillawalker.com'. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be the creation of a link farm, likely for SEO manipulation or to distribute potentially malicious content disguised as legitimate documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8215

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/barron-s-guide-to-medical-and-dental-schools-10th-edition.pdf In PDF document text
    • http://www.gorillawalker.com/be-bold-and-walk-tall-hardcover.pdfIn PDF document text
    • http://www.gorillawalker.com/como-disenar-un-stand-de-exhibicion-super-sin-gastar-una.pdfIn PDF document text
    • http://www.gorillawalker.com/christ-centered-meditation.pdfIn PDF document text
    • http://www.gorillawalker.com/some-notes-on-early-american-lithography-contained-in-proceedings-of.pdfIn PDF document text
    • http://www.gorillawalker.com/the-butterflies-of-the-malay-peninsula.pdfIn PDF document text
    • http://www.gorillawalker.com/power-up-with-pr-a-publicity-guide-for-artists.pdfIn PDF document text
    • http://www.gorillawalker.com/anxious-using-the-brain-to-understand-and-treat-fear-and.pdfIn PDF document text
    • http://www.gorillawalker.com/new-life-insurance-investment-advisor-achieving-financial-security-for-you.pdfIn PDF document text
    • http://www.gorillawalker.com/the-merman-s-lagoon.pdfIn PDF document text
    • http://www.gorillawalker.com/biomedical-signal-analysis-a-case-study-approach-ieee-press-series.pdfIn PDF document text
    • http://www.gorillawalker.com/let-s-go-2001-peru-bolivia-and-ecuador-including-the.pdfIn PDF document text
    • http://www.gorillawalker.com/conspiracy-girl.pdfIn PDF document text
    • http://www.gorillawalker.com/streetwise-spycraft-protect-yourself-and-learn-the-secret-skills-of.pdfIn PDF document text
    • http://www.gorillawalker.com/collection-development-for-the-school-library-media-program-a-beginner.pdfIn PDF document text
    • http://www.gorillawalker.com/caged-life-introductions-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/haiku-horizons-poems-of-travel-nature-and-topical-themes.pdfIn PDF document text
    • http://www.gorillawalker.com/amamani-puzzle-balls-annie-s-crochet.pdfIn PDF document text
    • http://www.gorillawalker.com/the-descendants-of-john-baker-ca-1640-1704-of-hartford.pdfIn PDF document text
    • http://www.gorillawalker.com/mehmed-the-conqueror-and-his-time.pdfIn PDF document text
    • http://www.gorillawalker.com/color-my-horse.pdfIn PDF document text
    • http://www.gorillawalker.com/trouble-in-paradise-a-rachel-knight-story-unabridged-audible-audio.pdfIn PDF document text
    • http://www.gorillawalker.com/lebanon-map-by-itmb-2004-travel-reference-map.pdfIn PDF document text
    • http://www.gorillawalker.com/the-wednesday-letters.pdfIn PDF document text
    • http://www.gorillawalker.com/master-spades-advanced-card-playing-technique-and-strategy-at-spades.pdfIn PDF document text
    • http://www.gorillawalker.com/original-christianity-a-new-key-to-understanding-the-gospel-of.pdfIn PDF document text
    • http://www.gorillawalker.com/second-language-acquisition-an-introductory-course-topics-in-applied-psycholinguistics.pdfIn PDF document text
    • http://www.gorillawalker.com/it-146-s-a-girl-but-will-she-live-the.pdfIn PDF document text
    • http://www.gorillawalker.com/islands-of-boston-harbor-snow-centennial-editions.pdfIn PDF document text
    • http://www.gorillawalker.com/el-golpe-a-la-democracia-dado-por-la-sala-constitucional.pdfIn PDF document text
    • http://www.gorillawalker.com/1174-elm.pdfIn PDF document text
    • http://www.gorillawalker.com/architectural-design-with-sketchup-component-based-modeling-plugins-rendering-and.pdfIn PDF document text
    • http://www.gorillawalker.com/pantheon-of-dermatology-outstanding-historical-figures.pdfIn PDF document text
    • http://www.gorillawalker.com/medicare-basics-in-plain-english-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/the-fifth-house-the-only-city-left-volume-2.pdfIn PDF document text
    • http://www.gorillawalker.com/le-vietnam-un-voyage-en-images-a-travers-le-vietnam.pdfIn PDF document text
    • http://www.gorillawalker.com/radamisto-hwv-12b-vocal-score.pdfIn PDF document text
    • http://www.gorillawalker.com/management-of-network-organizations-theoretical-problems-and-the-dilemmas-in.pdfIn PDF document text
    • http://www.gorillawalker.com/atsumori-imago-mundi-book-6-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/dynamics-of-shock-waves-explosions-and-detonations-progress-in-astronautics.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.