Malicious PDF — malware analysis report

Static analysis result for SHA-256 79c54c9dc40877e6…

MALICIOUS

PDF

43.8 KB Created: 2019-03-17 06:33:54 +03:00 Authoring application: FrameMaker 10.0.2 (via Acrobat Distiller 11.0 (Windows))
MD5: dcd7c85c43dbdb5c0e40dcf57fe54a91 SHA-1: 8d3451eb74afd57e6d7ea26a026da1cd4e827786 SHA-256: 79c54c9dc40877e6f606f074d176fe5c96b1e1499bf6c806b15b27f876a3affd
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing indicating a large number of external links, specifically pointing to PDF files on 'gorillawalker.com'. While no scripts were explicitly extracted, the nature of the embedded links suggests a potential distribution or SEO manipulation tactic. The ML classifier also flagged the document as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/history-of-early-new-york-building-america-s-democracy.pdf
    • http://www.gorillawalker.com/crime-prevention-approaches-practices-and-evaluations.pdf
    • http://www.gorillawalker.com/aprende-a-dibujar-gente-learn-how-to-draw-people-spanish.pdf
    • http://www.gorillawalker.com/an-introduction-to-peaf-pragmatic-enterprise-architecture-framework.pdf
    • http://www.gorillawalker.com/central-zentral-thailand-provinz-city-street-map-8858584000069.pdf
    • http://www.gorillawalker.com/iscience-course-1-grade-6-florida-edition.pdf
    • http://www.gorillawalker.com/doping-s-nemesis-arne-ljungqvist.pdf
    • http://www.gorillawalker.com/how-to-halt-diabetes-in-25-days.pdf
    • http://www.gorillawalker.com/otredad-orientalismo-e-identidad-nociones-sobre-la-construcci-n-de.pdf
    • http://www.gorillawalker.com/apocalipstick-spanish-edition.pdf
    • http://www.gorillawalker.com/expanded-interest-tables-for-the-engineer-in-training-and-professional.pdf
    • http://www.gorillawalker.com/t-t-clark-handbook-to-social-identity-in-the-new.pdf
    • http://www.gorillawalker.com/saving-your-marriage-how-to-love-staying-married-avoid-divorce.pdf
    • http://www.gorillawalker.com/italo-turkish-diplomacy-and-the-war-over-libya-1911-1912.pdf
    • http://www.gorillawalker.com/bibliographie-karl-barth-band-2-veroffentlichungen-uber-karl-barth-teil.pdf
    • http://www.gorillawalker.com/age-gap-lesbian-erotica-bundle-3-stories-featuring-hot-sex.pdf
    • http://www.gorillawalker.com/the-animal-story-book-dover-children-s-classics.pdf
    • http://www.gorillawalker.com/effective-medium-theory-principles-and-applications-international-series-of-monographs.pdf
    • http://www.gorillawalker.com/aerial-measurements-of-atmospheric-clarity-and-sky-luminance-near-alagogordo.pdf
    • http://www.gorillawalker.com/the-m-m-s-brand-chocolate-candies-counting-board-book.pdf
    • http://www.gorillawalker.com/strategic-air-command-warbirds-illustrated-no-9.pdf
    • http://www.gorillawalker.com/crete-in-the-greek-tradition-1915.pdf
    • http://www.gorillawalker.com/classic-grand-prix-cars-the-front-engined-formula-1-era.pdf
    • http://www.gorillawalker.com/far-from-over-kindle-edition.pdf
    • http://www.gorillawalker.com/composing-blues-for-jazz-performance.pdf
    • http://www.gorillawalker.com/our-america-the-pilgrim-adventure.pdf
    • http://www.gorillawalker.com/go-chinese-go100-workbook-traditional-characters.pdf
    • http://www.gorillawalker.com/open-canoe-technique-a-complete-guide-to-paddling-the-open.pdf
    • http://www.gorillawalker.com/advanced-knife-skills-in-theory-and-practice-advanced-knife-skills.pdf
    • http://www.gorillawalker.com/unclaimed-legacy-the-history-mystery-series-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/security-and-defensive-democracy-in-israel-a-critical-approach-to.pdf
    • http://www.gorillawalker.com/my-essential-oils-recipe-journal.pdf
    • http://www.gorillawalker.com/rethinking-military-history.pdf
    • http://www.gorillawalker.com/strings-attached.pdf
    • http://www.gorillawalker.com/women-and-war-a-historical-encyclopedia-from-antiquity-to-the.pdf
    • http://www.gorillawalker.com/partita-no-1-in-b-flat-major-kalmus-edition.pdf
    • http://www.gorillawalker.com/warrior-of-god-jan-zizka-and-the-hussite-revolution.pdf
    • http://www.gorillawalker.com/counselling-skills-for-palliative-care.pdf
    • http://www.gorillawalker.com/just-a-minute-the-best-of-2011.pdf
    • http://www.gorillawalker.com/america-the-litigious-the-death-of-personal-responsibility-essay-kindle.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.