Malicious PDF — malware analysis report

Static analysis result for SHA-256 777367268639d647…

MALICIOUS

PDF

42.6 KB Created: 2019-04-07 18:02:40 +03:00 Authoring application: Acrobat PDFMaker 7.0 for Publisher (via Acrobat Distiller 7.0 (Windows))
MD5: 77b74e1a5e390ae1c02d19ae7708d5ff SHA-1: e20decb3ceea10ab1a46b85cf0d63afaea271c8a SHA-256: 777367268639d64748167ad253d8fa2ab246edd09f156f0fb7f52ca862ef5701
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely intended for SEO manipulation or to distribute additional malicious content. While no scripts were explicitly extracted, the PDF structure and the heuristic 'PDF_SEO_LINK_FARM' strongly suggest malicious intent. The ML classifier also flagged the document as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8698

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/crocodiles-wild-reads.pdf
    • http://www.gorillawalker.com/a-nostalgic-look-at-belfast-trams-since-1945.pdf
    • http://www.gorillawalker.com/underworld-the-mysterious-origins-of-civilization-kindle-edition.pdf
    • http://www.gorillawalker.com/36-studies-for-trombone-book-2-blume-international-music-co.pdf
    • http://www.gorillawalker.com/doctors-discover-what-makes-you-sick-rosen-real-readers-stem.pdf
    • http://www.gorillawalker.com/phenomenology-and-theory-of-science-studies-in-phenomenology-and-existential.pdf
    • http://www.gorillawalker.com/super-cool-jokes-and-games-for-kids.pdf
    • http://www.gorillawalker.com/pens-es-dition-variorum-d-apr-s-le-texte-du.pdf
    • http://www.gorillawalker.com/mystery-of-the-yellow-room-the-first-detective-joseph-rouletabille.pdf
    • http://www.gorillawalker.com/boyd-and-the-past-a-look-at-the-utility-of.pdf
    • http://www.gorillawalker.com/children-s-atlas-of-endangered-animals.pdf
    • http://www.gorillawalker.com/christliche-existenz-zwischen-evangelium-und-gesetzlichkeit-darstellung-und-beurteilung-von.pdf
    • http://www.gorillawalker.com/beyond-the-wardrobe-the-official-guide-to-narnia.pdf
    • http://www.gorillawalker.com/facebook-jesus-using-facebook-to-build-and-grow-a-church.pdf
    • http://www.gorillawalker.com/boundaries-line-between-right-and-wrong.pdf
    • http://www.gorillawalker.com/i-kill-rich-people-volume-1.pdf
    • http://www.gorillawalker.com/the-dons.pdf
    • http://www.gorillawalker.com/mountain-bike-spanish-edition.pdf
    • http://www.gorillawalker.com/destruction-of-hazardous-chemicals-in-the-laboratory.pdf
    • http://www.gorillawalker.com/pennsylvania-bison-hunt-pennsylvania-deer-and-their-horns.pdf
    • http://www.gorillawalker.com/irs-secrets-from-the-nation-s-cash-register.pdf
    • http://www.gorillawalker.com/klimt-16-art-stickers-dover-art-stickers.pdf
    • http://www.gorillawalker.com/the-russian-theory-of-activity-current-applications-to-design-and.pdf
    • http://www.gorillawalker.com/archimedes-the-center-of-gravity-and-the-first-law-of.pdf
    • http://www.gorillawalker.com/international-money-postwar-trends-and-theories.pdf
    • http://www.gorillawalker.com/speaking-professionally-a-concise-guide-with-infotrac.pdf
    • http://www.gorillawalker.com/ability-assessment-for-older-people-comprehensive-assessment-minimum-data-set.pdf
    • http://www.gorillawalker.com/the-kurosagi-corpse-delivery-service-vol-10.pdf
    • http://www.gorillawalker.com/yudl-and-other-stories.pdf
    • http://www.gorillawalker.com/caring-for-everyone-ensuring-standards-of-care-for-black-and.pdf
    • http://www.gorillawalker.com/a-lark-ascends-florence-kate-upton-artist-and-illustrator.pdf
    • http://www.gorillawalker.com/misconduct-lorimer-sports-stories.pdf
    • http://www.gorillawalker.com/piezoelectric-accelerometers-with-integral-electronics.pdf
    • http://www.gorillawalker.com/i-ll-take-care-of-you-a-practical-guide-for.pdf
    • http://www.gorillawalker.com/the-art-of-understanding-art-a-new-perspective.pdf
    • http://www.gorillawalker.com/bukkake-wife-splattering-sumiko.pdf
    • http://www.gorillawalker.com/autohipnosis-spanish-edition.pdf
    • http://www.gorillawalker.com/the-davis-dynasty-fifty-years-of-successful-investing-on-wall.pdf
    • http://www.gorillawalker.com/10-minute-guide-to-word-pro-96-edition-for-windows.pdf
    • http://www.gorillawalker.com/the-problem-with-levinas.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.