Malicious PDF — malware analysis report

Static analysis result for SHA-256 82f3d61b5094e3e0…

MALICIOUS

PDF

41.6 KB Created: 2019-04-03 18:17:48 +03:00 Authoring application: LaTeX with hyperref package (via pdfeTeX-1.10b)
MD5: bf745af02596ece05bc3994cc9c12e1a SHA-1: ed6889c5511ad32fa3f3aa826f95fdb54dafc656 SHA-256: 82f3d61b5094e3e089bca620871292d123cc7a1a4673204222ae67483c41b1e5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the 'PDF_SEO_LINK_FARM' heuristic. These links point to various PDF documents on the 'gorillawalker.com' domain. The ML classifier also flagged the PDF as malicious. The primary purpose appears to be to direct users to a large collection of external PDFs, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/stationary-plasma-thruster-plume-characteristics-sudoc-nas-1-26-194454.pdf
    • http://www.gorillawalker.com/the-basic-works-of-aristotle-modern-library-classics.pdf
    • http://www.gorillawalker.com/alone-the-classic-story-of-his-admiral-richard-e-byrd.pdf
    • http://www.gorillawalker.com/classic-praise-worship-anthems-for-any-choir.pdf
    • http://www.gorillawalker.com/shift-tiny-tales-to-lighten-your-load.pdf
    • http://www.gorillawalker.com/getting-digital-marketing-right-a-simplified-process-for-business-growth.pdf
    • http://www.gorillawalker.com/clackers-bee-board-book.pdf
    • http://www.gorillawalker.com/natchez-burning-a-novel-penn-cage.pdf
    • http://www.gorillawalker.com/business-ethics-a-kantian-perspective.pdf
    • http://www.gorillawalker.com/signed-numbered-limited-edition-lithograph-print-of-pen-and-ink.pdf
    • http://www.gorillawalker.com/banned-manifestation-secrets-kindle-edition.pdf
    • http://www.gorillawalker.com/pleasure-the-new-series.pdf
    • http://www.gorillawalker.com/all-aboard-overnight-a-book-of-compound-words.pdf
    • http://www.gorillawalker.com/be-the-genius-you-were-born-to-be-10-secrets.pdf
    • http://www.gorillawalker.com/trips-and-developing-countries-towards-a-new-ip-world-order.pdf
    • http://www.gorillawalker.com/trees-of-new-york-state-native-and-naturalized.pdf
    • http://www.gorillawalker.com/proofreading-and-editing-precision-with-cd-rom.pdf
    • http://www.gorillawalker.com/standard-piano-classics-24-masterpieces-in-their-original-form-practical.pdf
    • http://www.gorillawalker.com/dream-horses-calendar-2006.pdf
    • http://www.gorillawalker.com/the-furies-violence-and-terror-in-the-french-and-russian.pdf
    • http://www.gorillawalker.com/rome-walks-on-foot-guides.pdf
    • http://www.gorillawalker.com/love-at-the-edge-based-on-true-accounts-from-the.pdf
    • http://www.gorillawalker.com/daily-life-in-the-age-of-sail-online.pdf
    • http://www.gorillawalker.com/advanced-placement-economics-macroeconomics-student-activities-by-john-s-morton.pdf
    • http://www.gorillawalker.com/byzantine-highlights-in-istanbul-top-5-byzantine-highlights-in-istanbul.pdf
    • http://www.gorillawalker.com/kandak.pdf
    • http://www.gorillawalker.com/sex-in-the-south-unbuckling-the-bible-belt.pdf
    • http://www.gorillawalker.com/update-on-troubleshooting-the-pvc-extrusion-process.pdf
    • http://www.gorillawalker.com/combinatorial-methods-in-discrete-distributions.pdf
    • http://www.gorillawalker.com/luc-ola-portuguese-edition.pdf
    • http://www.gorillawalker.com/hiroshima-immigrants-in-canada-1891-1941.pdf
    • http://www.gorillawalker.com/chirp-in-chinese-chinese-edition.pdf
    • http://www.gorillawalker.com/multivariable-calculus-hybrid-with-enhanced-webassign-homework-and-ebook-loe.pdf
    • http://www.gorillawalker.com/missed-connections-love-lost-found.pdf
    • http://www.gorillawalker.com/the-goat-song-story-of-athenian-lives-in-the-era.pdf
    • http://www.gorillawalker.com/le-br-hmanisme-french-edition.pdf
    • http://www.gorillawalker.com/bohemian-manifesto-a-field-guide-to-living-on-the-edge.pdf
    • http://www.gorillawalker.com/ferrari-f40-new-great-cars-series.pdf
    • http://www.gorillawalker.com/tomb-of-dracula-vol-1.pdf
    • http://www.gorillawalker.com/interpreting-china-as-a-regional-and-global-power-nationalism-and.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.