Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ad642108f9b0a8f…

MALICIOUS

PDF

44.4 KB Created: 2018-12-15 21:31:21 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 9.0.0 (Windows))
MD5: 9d31a745398b8b22a5dc3347d6ac2344 SHA-1: 3ea2794fd5a391a95084f0fa29c899747207f372 SHA-256: 6ad642108f9b0a8f010a5d1eed6fe879884d226853f8cb75c975ae0409998b0f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on 'www.gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute potentially malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/benedict-xvi-and-cardinal-newman.pdf
    • http://www.gorillawalker.com/computer-basics-absolute-beginner-s-guide-windows-10-edition-includes.pdf
    • http://www.gorillawalker.com/21-century-higher-education-general-theory-of-planning-science-and.pdf
    • http://www.gorillawalker.com/statistics-for-people-who-think-they-hate-statistics-excel-2007.pdf
    • http://www.gorillawalker.com/asterix-y-el-caldero-spanish-edition.pdf
    • http://www.gorillawalker.com/sitting-at-the-feet-of-jesus-spiritual-encounter-guide.pdf
    • http://www.gorillawalker.com/lessons-on-first-corinthians-lessons-on-the-new-testament-book.pdf
    • http://www.gorillawalker.com/performance-based-seismic-design-concepts-and-implementation-proceedings-of-an.pdf
    • http://www.gorillawalker.com/complete-contracts-torts-criminal-law-summaries-the-a-to-z.pdf
    • http://www.gorillawalker.com/sex-botany-and-empire-the-story-of-carl-linnaeus-and.pdf
    • http://www.gorillawalker.com/captain-phil-harris-the-legendary-crab-fisherman-our-hero-our.pdf
    • http://www.gorillawalker.com/children-s-books-and-their-creators.pdf
    • http://www.gorillawalker.com/the-way-we-cook-saveur-portraits-of-home-cooks-around.pdf
    • http://www.gorillawalker.com/apple-orchard-race-ready-freddy-20.pdf
    • http://www.gorillawalker.com/star-wars-solos-duets-trios-bass-book.pdf
    • http://www.gorillawalker.com/singapore-foreign-policy-and-government-guide-russia-investment-and-business.pdf
    • http://www.gorillawalker.com/theos-bernard-the-white-lama-tibet-yoga-and-american-religious.pdf
    • http://www.gorillawalker.com/birnbaum-s-walt-disney-world-2006.pdf
    • http://www.gorillawalker.com/seeing-the-invisible-national-security-intelligence-in-an-uncertain-age.pdf
    • http://www.gorillawalker.com/la-ovejita-que-vino-a-cenar-the-lamb-who-came.pdf
    • http://www.gorillawalker.com/russian-edition.pdf
    • http://www.gorillawalker.com/fighting-cancer-with-phytochemicals-tea-soy-and-blueberry-components-an.pdf
    • http://www.gorillawalker.com/the-politics-of-time-and-youth-in-brand-india-bargaining.pdf
    • http://www.gorillawalker.com/the-hidden-heart-of-the-cosmos-humanity-and-the-new.pdf
    • http://www.gorillawalker.com/a-pulley-how-can-i-experiment-with-simple-machines.pdf
    • http://www.gorillawalker.com/estimating-future-claims-case-studies-from-mass-tort-and-product.pdf
    • http://www.gorillawalker.com/fatigue-and-fracture-testing-of-weldments-astm-special-technical-publication.pdf
    • http://www.gorillawalker.com/submitting-to-the-russian-stranger-3-a-bdsm-love-story.pdf
    • http://www.gorillawalker.com/battletech-field-manual-crusader-clans.pdf
    • http://www.gorillawalker.com/mathematik-in-der-chemie-springer-lehrbuch-german-edition.pdf
    • http://www.gorillawalker.com/400-scrapbook-and-card-making-sketches-instant-inspiration-beautiful-scrapbook.pdf
    • http://www.gorillawalker.com/argentina-israel-y-los-judios-encuentros-y-desencuentros-spanish-edition.pdf
    • http://www.gorillawalker.com/verdi-master-musicians-series.pdf
    • http://www.gorillawalker.com/breaking-into-high-society-the-american-snob-handbook.pdf
    • http://www.gorillawalker.com/benjamin-graham-on-value-investing-lessons-from-the-dean-of.pdf
    • http://www.gorillawalker.com/commercial-mushroom-growing.pdf
    • http://www.gorillawalker.com/the-modern-voice-of-an-irish-immigrant.pdf
    • http://www.gorillawalker.com/out-island-doctor-import-hardcover.pdf
    • http://www.gorillawalker.com/by-charles-p-mckeague-elementary-and-intermediate-algebra-4th-edition.pdf
    • http://www.gorillawalker.com/the-loneliest-ranger.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.