Malicious PDF — malware analysis report

Static analysis result for SHA-256 830f26f3f38f2e73…

MALICIOUS

PDF

33.0 KB Created: 2019-12-14 07:11:08 +03:00 Authoring application: ScanSnap Manager (via Acrobat Distiller 10.1.7 (Windows))
MD5: df4a80054e0a2ac5f38acb4f66a4eaee SHA-1: fc66e9620b73353f0d756b150b322342d85ceec4 SHA-256: 830f26f3f38f2e7326959992bbddc1bf53e87dc69632d7b9214ca82d869fd5ab
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which point to various PDF documents on the 'gorillawalker.com' domain. This suggests a tactic to distribute or link to a large number of potentially malicious or unwanted files. The ML classifier also flagged the PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8313

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/book-of-lamentations-enhanced-e-book-edition-illustrated-includes-5.pdf
    • http://www.gorillawalker.com/sucker-rod-pumping-manual.pdf
    • http://www.gorillawalker.com/fanny-hill-harper-perennial-forbidden-classics.pdf
    • http://www.gorillawalker.com/harold-shipman-mind-set-on-murder.pdf
    • http://www.gorillawalker.com/architectures-for-computer-vision-from-algorithm-to-chip-with-verilog.pdf
    • http://www.gorillawalker.com/drugs-and-human-behavior-5th-fifth-edition-by-david-m.pdf
    • http://www.gorillawalker.com/adobe-premiere-elements-8.pdf
    • http://www.gorillawalker.com/frazzled-hurried-woman-your-stress-relief-guide-to-thriving-not.pdf
    • http://www.gorillawalker.com/pagan-adversary-harlequin-comics.pdf
    • http://www.gorillawalker.com/pseudofractures-hunger-osteopathy-late-rickets-osteomalacia.pdf
    • http://www.gorillawalker.com/rastitelnost-gobiiskikh-pustyn-mongolii-mongol-orny-goviin-urgamalzhil-mongol-orny.pdf
    • http://www.gorillawalker.com/ride-me-hard-take-me-hard-book-1.pdf
    • http://www.gorillawalker.com/re-estimation-of-lms-time-of-day-module-project-estimation.pdf
    • http://www.gorillawalker.com/b-renweihnacht.pdf
    • http://www.gorillawalker.com/the-essential-guide-to-handling-workplace-harassment-discrimination.pdf
    • http://www.gorillawalker.com/determining-health-expectancies.pdf
    • http://www.gorillawalker.com/swimming-at-night.pdf
    • http://www.gorillawalker.com/mike-weir-the-road-to-the-masters.pdf
    • http://www.gorillawalker.com/awakening-hippocrates-a-primer-on-health-poverty-and-global-service.pdf
    • http://www.gorillawalker.com/sanctuary-practices-in-international-perspectives-migration-citizenship-and-social-movements.pdf
    • http://www.gorillawalker.com/letters-to-penthouse-xiv-open-house-and-open-season-for.pdf
    • http://www.gorillawalker.com/fighter-planes-of-world-war-ii-wings-of-war.pdf
    • http://www.gorillawalker.com/designing-courses-and-obstacles.pdf
    • http://www.gorillawalker.com/the-raven-deception.pdf
    • http://www.gorillawalker.com/the-physics-of-superheroes-spectacular-second-edition.pdf
    • http://www.gorillawalker.com/flowers-follow-the-dots.pdf
    • http://www.gorillawalker.com/travel-journal-florence.pdf
    • http://www.gorillawalker.com/my-mother-said-i-never-should-modern-plays.pdf
    • http://www.gorillawalker.com/us-army-technical-manual-tm-5-6115-423-15-load.pdf
    • http://www.gorillawalker.com/mosby-s-review-questions-for-the-national-board-dental-hygiene.pdf
    • http://www.gorillawalker.com/wisconsin-county-maps.pdf
    • http://www.gorillawalker.com/military-living-s-military-space-a-air-opportunities-around-the.pdf
    • http://www.gorillawalker.com/how-to-teach-relativity-to-your-dog-kindle-edition.pdf
    • http://www.gorillawalker.com/cold-warriors-a-special-agent-dylan-kane-thriller-book-3.pdf
    • http://www.gorillawalker.com/mexican-americans-and-the-question-of-race.pdf
    • http://www.gorillawalker.com/the-last-kingdom-the-saxon-chronicles-series-1.pdf
    • http://www.gorillawalker.com/transradial-access-techniques-for-diagnostic-angiography-and-percutaneous-intervention.pdf
    • http://www.gorillawalker.com/int-cong-elect-microsc-vol-2.pdf
    • http://www.gorillawalker.com/ask-me-no-questions.pdf
    • http://www.gorillawalker.com/microsoft-r-dynamics-ax-r-interview-questions-unofficial-microsoft-dynamics.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.