Malicious PDF — malware analysis report

Static analysis result for SHA-256 85658498d8788593…

MALICIOUS

PDF

45.0 KB Created: 2019-03-17 09:53:54 +03:00 Authoring application: Acrobat PDFMaker 10.1 для Word (via Adobe PDF Library 10.0)
MD5: 349ca47b9c51328f7e4705d8dd4850cc SHA-1: e7f55e9aff80ab6335cd6c49653404d736476c35 SHA-256: 85658498d8788593b2708e2e08fd86c1a4f0ddce4c47cdd07dd2beafe779a83a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier as malicious. A critical heuristic identified it as a PDF link farm containing 32 external links, with the first URL being http://www.gorillawalker.com/daniel-visits-the-library-daniel-tiger-s-neighborhood.pdf. This suggests the document's primary purpose is to distribute links, likely for SEO manipulation or to lead users to malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8173

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/daniel-visits-the-library-daniel-tiger-s-neighborhood.pdf
    • http://www.gorillawalker.com/yoga-nidra-for-complete-relaxation-and-stress-relief.pdf
    • http://www.gorillawalker.com/bolero-full-score.pdf
    • http://www.gorillawalker.com/zhonghua-zhu-zhi-ci-mandarin-chinese-edition.pdf
    • http://www.gorillawalker.com/rough-guides-snapshot-ireland-belfast-rough-guide-to.pdf
    • http://www.gorillawalker.com/the-oxford-duden-pictorial-english-dictionary.pdf
    • http://www.gorillawalker.com/the-apocalypse-explained-according-to-the-spiritual-sense-in-which.pdf
    • http://www.gorillawalker.com/modelling-and-simulation-in-air-traffic-management-transportation-analysis.pdf
    • http://www.gorillawalker.com/many-changes-and-more-in-store-for-canton-nissan-motor.pdf
    • http://www.gorillawalker.com/living-liturgy-spirituality-celebration-and-catechesis-for-sundays-and-solemnities.pdf
    • http://www.gorillawalker.com/warriors-dawn-of-the-clans-1-the-sun-trail.pdf
    • http://www.gorillawalker.com/full-house-the-spread-of-excellence-from-plato-to-darwin.pdf
    • http://www.gorillawalker.com/dick-won-t-quit-when-your-mind-is-willing-but.pdf
    • http://www.gorillawalker.com/bitter-blood-the-vampire-legacy-2-mass-market-paperback.pdf
    • http://www.gorillawalker.com/the-finding-of-jasper-holt.pdf
    • http://www.gorillawalker.com/night-of-the-dragons-dragons-of-autumn-twilight-vol-2.pdf
    • http://www.gorillawalker.com/current-bibliographical-sources-in-education-u1391.pdf
    • http://www.gorillawalker.com/learn-biblical-hebrew-pack-integrated-for-use-with-basics-of.pdf
    • http://www.gorillawalker.com/samurai-warriors-graphic-illustrated.pdf
    • http://www.gorillawalker.com/jazz-standards-for-ukulele-includes-bonus-mouth-trumpet-lesson.pdf
    • http://www.gorillawalker.com/the-book-of-indian-animals-indian-natural-history-series.pdf
    • http://www.gorillawalker.com/analysis-and-numerics-for-conservation-laws.pdf
    • http://www.gorillawalker.com/other-realities-the-enigma-of-franek-kluski-s-mediumship.pdf
    • http://www.gorillawalker.com/beginning-oracle-application-express-5.pdf
    • http://www.gorillawalker.com/the-storyteller-s-start-up-book-finding-learning-performing-and.pdf
    • http://www.gorillawalker.com/the-key-to-the-pacific-the-nicaragua-canal.pdf
    • http://www.gorillawalker.com/iqbal-and-the-english-romantics.pdf
    • http://www.gorillawalker.com/workbook-lippincott-s-textbook-for-nursing-assistants-a-humanistic-approach.pdf
    • http://www.gorillawalker.com/the-darkling-wind.pdf
    • http://www.gorillawalker.com/italia-op-11-tuba-part-qty-2-a6455.pdf
    • http://www.gorillawalker.com/traversing-the-wild-terrain-of-menopause-herbal-allies-for-midlife.pdf
    • http://www.gorillawalker.com/high-pressure-molecular-science-nato-science-series-e.pdf
    • http://www.gorillawalker.com/george-mason-forgotten-founder.pdf
    • http://www.gorillawalker.com/stay-carl-stay-best-half-foot-forward-and-pillow-talk.pdf
    • http://www.gorillawalker.com/aspects-of-distribution-of-wealth-income-the-jerome-levy-economics.pdf
    • http://www.gorillawalker.com/calendario-el-principito-2014-antes-de-ser-mayores-todos-he.pdf
    • http://www.gorillawalker.com/tentacle-erotica-three-pack-tentacle-erotica-bundle-book-1.pdf
    • http://www.gorillawalker.com/e-flash-fiction-book-1.pdf
    • http://www.gorillawalker.com/the-naval-long-service-medals-1830-1990.pdf
    • http://www.gorillawalker.com/water-for-health-for-healing-for-life-you-re-not.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.