Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ad24f33106e9d33…

MALICIOUS

PDF

36.5 KB Created: 2019-12-14 01:51:20 +03:00 Authoring application: Data Dynamics ActiveReports (tm) for .NET
MD5: b4efdc994f9866feee050412a7c13710 SHA-1: 02e6d70ee92259a8d1d7e1ad8d5acb95646961be SHA-256: 7ad24f33106e9d33d8e2f3c4f85408604d69cb1dbe9de2d12e2f6cba597b46d5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm or SEO manipulation tactic, potentially used to distribute malicious content or drive traffic. While no scripts were explicitly extracted, the PDF structure and the heuristic 'PDF_SEO_LINK_FARM' strongly suggest this malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8218

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-oxford-handbook-of-governance-oxford-handbooks.pdf
    • http://www.gorillawalker.com/the-tyranny-of-printers-newspaper-politics-in-the-early-american.pdf
    • http://www.gorillawalker.com/kentucky-by-design-the-decorative-arts-and-american-culture.pdf
    • http://www.gorillawalker.com/used-car-prices-january-2000-cars-vans-trucks-sport-utilities.pdf
    • http://www.gorillawalker.com/how-to-write-construction-programmes-schedules-kindle-edition.pdf
    • http://www.gorillawalker.com/great-expectations-health-fitness-leanness-without-suffering.pdf
    • http://www.gorillawalker.com/the-executive-guide-to-washington-dc.pdf
    • http://www.gorillawalker.com/captive-hearts-captive-minds-freedom-and-recovery-from-cults-and.pdf
    • http://www.gorillawalker.com/35-essential-content-marketing-tasks-for-your-virtual-assistant-kindle.pdf
    • http://www.gorillawalker.com/some-of-the-words-are-theirs-a-memoir-of-an.pdf
    • http://www.gorillawalker.com/the-reluctant-outlaw-love-inspired-historical.pdf
    • http://www.gorillawalker.com/the-last-kids-on-earth.pdf
    • http://www.gorillawalker.com/diffusion-of-innovations-in-health-service-organisations-a-systematic-literature.pdf
    • http://www.gorillawalker.com/the-know-it-all-one-man-s-humble-quest-to.pdf
    • http://www.gorillawalker.com/white-sugar-lover-interracial-romance-stories-bwwm.pdf
    • http://www.gorillawalker.com/mostrando-mi-lado-salvaje-spanish-edition.pdf
    • http://www.gorillawalker.com/caffeine-an-entry-from-thomson-gale-s-gale-encyclopedia-of.pdf
    • http://www.gorillawalker.com/the-king-arthur-trilogy-book-three-the-bloody-cup.pdf
    • http://www.gorillawalker.com/by-samuel-terrien-golden-bible-atlas-13th-printing-hardcover.pdf
    • http://www.gorillawalker.com/el-bebe-de-los-osos-berenstain-bbears-new-baby.pdf
    • http://www.gorillawalker.com/stirred-not-shaken-sermons-for-an-emerging-generation.pdf
    • http://www.gorillawalker.com/knowledge-management-chinese-edition.pdf
    • http://www.gorillawalker.com/soldier-s-handbook-for-chemical-and-biological-operations-and-nuclear.pdf
    • http://www.gorillawalker.com/blood-runs-cold-on-the-black-side-of-the-mountain.pdf
    • http://www.gorillawalker.com/black-inspiration.pdf
    • http://www.gorillawalker.com/multiaxiales-klassifikationsschema-fur-psychiatrische-erkrankungen-im-kindes-und-jugendalter-nach.pdf
    • http://www.gorillawalker.com/oevvres-dv-chanoine-loys-papon-seigneur-de-marcilly-po-te.pdf
    • http://www.gorillawalker.com/casebooks-on-economic-principles-6v-in-1v.pdf
    • http://www.gorillawalker.com/heart-valve-engineering.pdf
    • http://www.gorillawalker.com/poetry-in-person-twenty-five-years-of-conversation-with-america.pdf
    • http://www.gorillawalker.com/a-few-observations-on-the-mode-of-attack-and-employment.pdf
    • http://www.gorillawalker.com/adc-the-map-people-sussex-county-delaware.pdf
    • http://www.gorillawalker.com/going-deep-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/fore-the-best-of-wodehouse-on-golf.pdf
    • http://www.gorillawalker.com/lo-specchio-nero-italian-edition.pdf
    • http://www.gorillawalker.com/bacterial-endotoxic-lipopolysaccharides.pdf
    • http://www.gorillawalker.com/the-walking-dead-14-in-der-falle-german-edition-kindle.pdf
    • http://www.gorillawalker.com/colecc-on-de-historiadores-de-chile-y-documentos-relativos-a.pdf
    • http://www.gorillawalker.com/transformed-5-resurrection-dramas.pdf
    • http://www.gorillawalker.com/dawson-s-creek-playing-for-keeps-v-11-vol-11.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.