Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f5b76b33d8280b4…

MALICIOUS

PDF

42.5 KB Created: 2018-11-14 08:22:48 +03:00 Authoring application: - (via ABBYY FineReader 11)
MD5: 84f1cc8b91e197f2e7e1dab05405ecb6 SHA-1: f898c0ad29705df06f0f99689f73007d7cd53150 SHA-256: 7f5b76b33d8280b4a18a95a65036f3fbcb4cde0893a071bbd40a67e0e9b24502
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded URLs pointing to PDF files on the domain 'www.gorillawalker.com'. This suggests a link farm or redirection tactic, likely intended to lead users to malicious content or phishing pages hosted on these external PDFs. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/if-angels-burn-a-novel-of-the-darkyn.pdf
    • http://www.gorillawalker.com/razzle-dazzle-disney-princess-palace-pets-hologramatic-sticker-book.pdf
    • http://www.gorillawalker.com/magic-totem-the-adventures-of-pokey-and-sparky-book-4.pdf
    • http://www.gorillawalker.com/emergency-animal-rescue-stories-one-woman-146-s-dedication-to.pdf
    • http://www.gorillawalker.com/the-400-best-garden-plants-a-practical-encyclodpedia-of-annuals.pdf
    • http://www.gorillawalker.com/the-people-s-health-1830-1910.pdf
    • http://www.gorillawalker.com/chiapanecas-mexican-clap-dance-score-parts.pdf
    • http://www.gorillawalker.com/creating-family-harmony-through-tanka.pdf
    • http://www.gorillawalker.com/the-carolina-way-leadership-lessons-from-a-life-in-coaching.pdf
    • http://www.gorillawalker.com/introduction-to-agricultural-engineering-technology-a-problem-solving-approach.pdf
    • http://www.gorillawalker.com/los-duendes-zapateros-versi-n-del-cuento-de-los-hermanos.pdf
    • http://www.gorillawalker.com/jacob-s-wake.pdf
    • http://www.gorillawalker.com/i-do-wish-this-cruel-war-was-over-first-person.pdf
    • http://www.gorillawalker.com/prentice-hall-writers-companion-middle-grades-student-text.pdf
    • http://www.gorillawalker.com/renewable-energy.pdf
    • http://www.gorillawalker.com/us-army-technical-manual-landing-craft-utility-lcu-1671-1679.pdf
    • http://www.gorillawalker.com/chip-dip-lovers-cook-book.pdf
    • http://www.gorillawalker.com/the-exile-ryan-kealey-series.pdf
    • http://www.gorillawalker.com/barbershops-bibles-and-bet-everyday-talk-and-black-political-thought.pdf
    • http://www.gorillawalker.com/african-animals-portraits-of-a-special-kind-wonderful-artistic-photographs.pdf
    • http://www.gorillawalker.com/premarital-counseling.pdf
    • http://www.gorillawalker.com/street-fight-psychology-kindle-edition.pdf
    • http://www.gorillawalker.com/lever-of-empire-the-international-gold-standard-and-the-crisis.pdf
    • http://www.gorillawalker.com/oral-surgery-a-text-book-on-general-medicine-and-surgery.pdf
    • http://www.gorillawalker.com/a21-port-fuel-injection-package.pdf
    • http://www.gorillawalker.com/u-s-immigration-cartoon-nation.pdf
    • http://www.gorillawalker.com/columbus-indiana-midwestern-modernist-mecca.pdf
    • http://www.gorillawalker.com/montessori-inspired-activities-for-pre-schoolers-home-based-projects-for.pdf
    • http://www.gorillawalker.com/how-to-draw-people-young-artist-series.pdf
    • http://www.gorillawalker.com/mozart-for-oboe-book-with-cd.pdf
    • http://www.gorillawalker.com/practical-fracture-mechanics-in-design-mechanical-engineering-marcel-dekker-hardcover.pdf
    • http://www.gorillawalker.com/chimera-parasitology.pdf
    • http://www.gorillawalker.com/tlv-1-safe-use-of-chemicals-in-the-laboratory.pdf
    • http://www.gorillawalker.com/american-style.pdf
    • http://www.gorillawalker.com/job-stress-interventions.pdf
    • http://www.gorillawalker.com/addicted-to-angling-a-lifetime-s-obsession-with-fish-and.pdf
    • http://www.gorillawalker.com/easy-to-play-israeli-jewish-song-hits-israeli-jewish-songbooks.pdf
    • http://www.gorillawalker.com/act-like-a-lady-think-like-a-boss-motivational-quotes.pdf
    • http://www.gorillawalker.com/king-of-beaver-island.pdf
    • http://www.gorillawalker.com/troubleshooting-electrical-electronic-systems-workbook.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.