Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fb86bc3ad3a1d42…

MALICIOUS

PDF

45.9 KB Created: 2019-02-15 20:05:42 +03:00 Authoring application: Adobe InDesign CS6 (Macintosh) (via Acrobat Distiller 10.1.12 (Macintosh))
MD5: f0a9bc18ffeccccbf93b200c8af3dd6d SHA-1: 4b4cb778dbfdea74135b868c552be34819836611 SHA-256: 7fb86bc3ad3a1d425bc25e7df8e9784bd077d76ad5ed188def993e7b783e9c68
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this file as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or distribute potentially malicious content hosted on the 'gorillawalker.com' domain. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/la-bibbia-dei-bambini-fumetto-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/equipment-leasing-leveraged-leasing.pdf
    • http://www.gorillawalker.com/military-operations-france-and-belgium-1916-to-the-1st-july.pdf
    • http://www.gorillawalker.com/dom-s-guide-to-submissive-training-step-by-step-blueprint.pdf
    • http://www.gorillawalker.com/disney-princesas-cuentos-para-dormir-princess-bedtime-stories-spanish-edition.pdf
    • http://www.gorillawalker.com/cocina-en-microondas-spanish-edition.pdf
    • http://www.gorillawalker.com/beholden-book-two-in-the-belonging-duet.pdf
    • http://www.gorillawalker.com/the-star-trek-the-art-of-star-trek.pdf
    • http://www.gorillawalker.com/die-filmverhinderer-wie-ard-und-zdf-das-geschichtenerz-hlen-behindern.pdf
    • http://www.gorillawalker.com/vampire-alpha-claim-1-brief-bites-novelette-kindle-edition.pdf
    • http://www.gorillawalker.com/organic-chemistry-of-photography.pdf
    • http://www.gorillawalker.com/mixture-formation-in-spark-ignition-engines.pdf
    • http://www.gorillawalker.com/a-tour-of-your-digestive-system-first-graphics-body-systems.pdf
    • http://www.gorillawalker.com/health-risks-to-female-workers-in-occupational-exposure-to-chemical.pdf
    • http://www.gorillawalker.com/international-fascism-theories-causes-and-the-new-consensus-arnold-readers.pdf
    • http://www.gorillawalker.com/creative-strategy-reconnecting-business-and-innovation.pdf
    • http://www.gorillawalker.com/grant-writing-strategies-for-developing-winning-proposals-2nd-edition.pdf
    • http://www.gorillawalker.com/allen-s-key-notes-rearranged-classified-with-leading-remedies-of.pdf
    • http://www.gorillawalker.com/james-t-shotwell-and-the-rise-of-internationalism-in-america.pdf
    • http://www.gorillawalker.com/travis-picking-instructional-guitar-book-cd.pdf
    • http://www.gorillawalker.com/the-brothers-bishop.pdf
    • http://www.gorillawalker.com/advancing-the-careers-of-military-spouses-an-assessment-of-education.pdf
    • http://www.gorillawalker.com/transforming-electricity-the-coming-generation-of-change.pdf
    • http://www.gorillawalker.com/the-oxford-dictionary-of-plays.pdf
    • http://www.gorillawalker.com/make-training-grants-work-for-you-the-u-s-job.pdf
    • http://www.gorillawalker.com/map-folio-ii-dungeons-dragons-accessory.pdf
    • http://www.gorillawalker.com/separation-a-historical-romance-novel-about-forbidden-love-like-kindred.pdf
    • http://www.gorillawalker.com/tatted.pdf
    • http://www.gorillawalker.com/teaching-languages-to-students-with-specific-learning-differences-0-mm.pdf
    • http://www.gorillawalker.com/handbuch-schulpsychologie-psychologie-f-r-die-schule-german-edition.pdf
    • http://www.gorillawalker.com/cambiaron-la-historia-spanish-edition.pdf
    • http://www.gorillawalker.com/avancemos-1a.pdf
    • http://www.gorillawalker.com/night-riders-in-black-folk-history.pdf
    • http://www.gorillawalker.com/naughty-tiffany-gets-stuffed-taboo-bareback-erotica.pdf
    • http://www.gorillawalker.com/fuzzy-hardware-architectures-and-applications.pdf
    • http://www.gorillawalker.com/oxbridge-men-british-masculinity-and-the-undergraduate-experience-1850-1920.pdf
    • http://www.gorillawalker.com/the-lost-years-book-1-merlin.pdf
    • http://www.gorillawalker.com/logic-methodology-and-philosophy-of-science-iii-proceedings-of-the.pdf
    • http://www.gorillawalker.com/one-year-lived.pdf
    • http://www.gorillawalker.com/books-of-the-dead-manuals-for-living-and-dying-art.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.