Malicious PDF — malware analysis report

Static analysis result for SHA-256 86f849e7e4416465…

MALICIOUS

PDF

32.6 KB Created: 2019-12-14 08:37:06 +03:00 Authoring application: doPDF Ver 7.3 Build 391 (Windows 7 Home Premium Edition (SP 1) - Version: 6.1.7601 (x64))
MD5: daf7b5e281ac517bb06505319bc629db SHA-1: 6a89e0a535ef2716b53d2e991e1eff99ac4e7620 SHA-256: 86f849e7e4416465f75f0043c29414f034093b953b815bf0ac35712635ecb567
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute potentially malicious content. While no scripts were explicitly extracted, the heuristic 'PDF_SEO_LINK_FARM' strongly suggests this malicious intent. The ML classifier also flagged the PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/tractor-mac-harvest-time.pdf
    • http://www.gorillawalker.com/the-fibromyalgia-relief-book-213-ideas-for-improving-your-quality.pdf
    • http://www.gorillawalker.com/aircraft-systems-for-pilots-reprint-ed-js312686.pdf
    • http://www.gorillawalker.com/dying-well-a-guide-to-enabling-a-good-death.pdf
    • http://www.gorillawalker.com/the-black-heralds-other-early-poems.pdf
    • http://www.gorillawalker.com/a-rhyme-is-a-terrible-thing-to-waste-hip-hop.pdf
    • http://www.gorillawalker.com/the-keeper-vega-jane-series.pdf
    • http://www.gorillawalker.com/materia-medica-of-ayurveda-based-on-madanapala-s-nighantu.pdf
    • http://www.gorillawalker.com/raising-boys-is-a-full-contact-sport.pdf
    • http://www.gorillawalker.com/robert-e-lee-the-story-of-the-great-confederate-general.pdf
    • http://www.gorillawalker.com/essential-emergency-medicine-for-the-healthcare-practitioner-1e.pdf
    • http://www.gorillawalker.com/vacation-on-mars-the-solar-system-for-young-explorers-a.pdf
    • http://www.gorillawalker.com/my-heart-toward-home-letters-of-a-family-during-the.pdf
    • http://www.gorillawalker.com/fighting-chess-with-magnus-carlsen-progress-in-chess.pdf
    • http://www.gorillawalker.com/french-wine-for-dummies.pdf
    • http://www.gorillawalker.com/the-consulting-bible-everything-you-need-to-know-to-create.pdf
    • http://www.gorillawalker.com/green-history-a-reader-in-environmental-literature-philosophy-and-politics.pdf
    • http://www.gorillawalker.com/helicopter-pilot-oral-exam-guide-oral-exam-guide-series.pdf
    • http://www.gorillawalker.com/how-to-stubbornly-refuse-to-make-yourself-miserable-about-anything.pdf
    • http://www.gorillawalker.com/reversing-gum-disease-naturally-a-holistic-home-care-program-kindle.pdf
    • http://www.gorillawalker.com/more-bread-machine-magic-kindle-edition.pdf
    • http://www.gorillawalker.com/tauberian-theory-a-century-of-developments-grundlehren-der-mathematischen-wissenschaften.pdf
    • http://www.gorillawalker.com/yu-gi-oh-gx-vol-8.pdf
    • http://www.gorillawalker.com/philly-wall-hiphop-haiku-vol-2-hiphop-h-a-i.pdf
    • http://www.gorillawalker.com/control-of-unsteady-aerodynamic-forces.pdf
    • http://www.gorillawalker.com/orgullo-y-prejuicio-el-amanecer-de-los-zombis-spanish-edition.pdf
    • http://www.gorillawalker.com/beyond-strength-psychological-profiles-of-olympic-athletes.pdf
    • http://www.gorillawalker.com/information-technology-dod-needs-to-leverage-lessons-learned-from-its.pdf
    • http://www.gorillawalker.com/encounters-with-nature-essays-by-paul-shepard.pdf
    • http://www.gorillawalker.com/une-tonnante-retraite-du-monde-entier-french-edition.pdf
    • http://www.gorillawalker.com/the-second-person-perspective-in-aquinas-s-ethics-virtues-and.pdf
    • http://www.gorillawalker.com/navy-maintenance-assessment-of-the-public-private-competition-program-for.pdf
    • http://www.gorillawalker.com/contemporary-financial-issues-in-student-affairs-new-directions-for-student.pdf
    • http://www.gorillawalker.com/comic-art-eye-on-art.pdf
    • http://www.gorillawalker.com/tooth-fairy-kit.pdf
    • http://www.gorillawalker.com/tropic-suns-seadogs-aboard-an-english-galleon.pdf
    • http://www.gorillawalker.com/where-is-the-lone-ranger-second-edition-america-s-search.pdf
    • http://www.gorillawalker.com/acute-resuscitation-and-crisis-management-acute-critical-events-simulation-aces.pdf
    • http://www.gorillawalker.com/rugby-the-art-of-scrummaging.pdf
    • http://www.gorillawalker.com/push-pull-tests-for-site-characterization-lecture-notes-in-earth.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.