Malicious PDF — malware analysis report

Static analysis result for SHA-256 75702f6734d50bdd…

MALICIOUS

PDF

43.4 KB Created: 2019-03-17 12:32:45 +03:00 Authoring application: Adobe Acrobat 8.1 Combine Files (via Acrobat Distiller 8.1.0 (Windows))
MD5: a6632721c33e21128eb7bd62f6ad3e68 SHA-1: 70a6e6f94c42d4a061b65375c2f616417be07bf3 SHA-256: 75702f6734d50bdd2bdb23856d579d56a886042aafcfc2110c390b5a56d9655e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a vast collection of documents hosted on 'gorillawalker.com', which is a common tactic for SEO manipulation or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/to-world.pdf
    • http://www.gorillawalker.com/betrayal-how-union-bosses-shake-down-their-members-and-corrupt.pdf
    • http://www.gorillawalker.com/church-of-martyrs.pdf
    • http://www.gorillawalker.com/math-through-children-s-literature-making-the-nctm-standards-come.pdf
    • http://www.gorillawalker.com/against-the-sky-the-brodies-of-alaska-book-2-kindle.pdf
    • http://www.gorillawalker.com/tales-from-shakespeare-macbeth.pdf
    • http://www.gorillawalker.com/made-in-america-a-social-history-of-american-culture-and.pdf
    • http://www.gorillawalker.com/eastham-ma-images-of-america.pdf
    • http://www.gorillawalker.com/advanced-estate-planning-with-forms.pdf
    • http://www.gorillawalker.com/exotic-cuisine-greek-language-edition-greek-edition.pdf
    • http://www.gorillawalker.com/deviant-eyes-deviant-bodies.pdf
    • http://www.gorillawalker.com/real-llanelli-the-real-wales-series.pdf
    • http://www.gorillawalker.com/work-out-chemistry-gcse-macmillan-work-out.pdf
    • http://www.gorillawalker.com/witness-preparation-and-examination-for-dui-proceedings-2010-ed-leading.pdf
    • http://www.gorillawalker.com/women-work-the-art-of-savoir-faire-business-sense-sensibility.pdf
    • http://www.gorillawalker.com/rise-of-the-wheat-state-a-history-of-kansas-agriculture.pdf
    • http://www.gorillawalker.com/teach-yourself-visually-beadwork-learning-off-loom-beading-techniques-one.pdf
    • http://www.gorillawalker.com/a-feast-for-the-eyes-art-performance-and-the-late.pdf
    • http://www.gorillawalker.com/10000-medium-spellrex-puzzles-to-improve-your-iq-spelling-iq.pdf
    • http://www.gorillawalker.com/historical-genesis-from-adam-to-abraham.pdf
    • http://www.gorillawalker.com/iso-11607-1-2006-packaging-for-terminally-sterilized-medical-devices.pdf
    • http://www.gorillawalker.com/catalogue-of-clocks-scientific-instruments-and-watches.pdf
    • http://www.gorillawalker.com/texas-true-the-tylers-of-texas.pdf
    • http://www.gorillawalker.com/research-methods-for-arts-and-event-management.pdf
    • http://www.gorillawalker.com/strong-wilde-2-kindle-edition.pdf
    • http://www.gorillawalker.com/milton-caniff-s-steve-canyon-1949-steve-canyon-series.pdf
    • http://www.gorillawalker.com/weight-loss-confidential-how-teens-lose-weight-and-keep-it.pdf
    • http://www.gorillawalker.com/test-and-evaluation-of-aircraft-avionics-and-weapon-systems-aiaa.pdf
    • http://www.gorillawalker.com/predator-a-play.pdf
    • http://www.gorillawalker.com/one-hundred-frogs-from-renga-to-haiku-to-english.pdf
    • http://www.gorillawalker.com/oxford-international-primary-maths-stage-5-age-9-10-student.pdf
    • http://www.gorillawalker.com/the-quindecile-the-astrology-psychology-of-obsession.pdf
    • http://www.gorillawalker.com/take-place-photography-and-place-from-multiple-perspectives.pdf
    • http://www.gorillawalker.com/iso-10005-2005-quality-management-systems-guidelines-for-quality-plans.pdf
    • http://www.gorillawalker.com/godwin-s-political-justice-a-reprint-of-the-essay-on.pdf
    • http://www.gorillawalker.com/mindfulness-and-acceptance-expanding-the-cognitive-behavioral-tradition.pdf
    • http://www.gorillawalker.com/your-amazing-heart-dr-lee-s-health-secrets-book-one.pdf
    • http://www.gorillawalker.com/medical-biochemistry-the-big-picture-lange-the-big-picture.pdf
    • http://www.gorillawalker.com/streichquartett-roman-german-edition.pdf
    • http://www.gorillawalker.com/marketing-an-introduction-gary-armstrong-philip-kotler.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.