Malicious PDF — malware analysis report

Static analysis result for SHA-256 8799f9dcccc08b3c…

MALICIOUS

PDF

43.5 KB Created: 2018-12-02 10:55:15 +03:00 Authoring application: Microsoft Word (via Acrobat PDFWriter 4.0 para Windows)
MD5: f1aeccfae9a205df25d8f466ed0486e5 SHA-1: e98547969825daceb1dd61a5d93531cde0e8bd3e SHA-256: 8799f9dcccc08b3ce9d16b21dd145fd4915185d57f875e28696ddf6238a9f4fb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded links to external PDF files, forming a link farm. The document body is heavily obfuscated and does not provide clear textual content, but the presence of numerous links suggests a social engineering attempt to direct users to potentially malicious or unwanted content hosted on the 'gorillawalker.com' domain.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/secrets-of-a-reluctant-mistress-domination-and-submission.pdf
    • http://www.gorillawalker.com/a-wrinkle-in-time-50th-anniversary-commemorative-edition-a-wrinkle.pdf
    • http://www.gorillawalker.com/the-pleasure-principle-sex-backlash-and-the-struggle-for-gay.pdf
    • http://www.gorillawalker.com/an-american-adventure-in-bookburning-in-the-style-of-1918.pdf
    • http://www.gorillawalker.com/the-listener-s-musical-companion.pdf
    • http://www.gorillawalker.com/the-berenstain-bears-kindness-counts-berenstain-bears-living-lights.pdf
    • http://www.gorillawalker.com/a-revision-of-the-tribe-antirrhineae-scrophulariaceae.pdf
    • http://www.gorillawalker.com/the-graphic-arts-of-great-britain-drawing-line-engraving-etching.pdf
    • http://www.gorillawalker.com/the-boxer-s-workout.pdf
    • http://www.gorillawalker.com/legal-reasoning-research-and-writing-for-international-graduate-students-third.pdf
    • http://www.gorillawalker.com/when-globalization-fails-the-rise-and-fall-of-pax-americana.pdf
    • http://www.gorillawalker.com/the-dystopian-impulse-in-modern-literature-fiction-as-social-criticism.pdf
    • http://www.gorillawalker.com/thomas-jefferson-third-president-1801-1809-getting-to-know-the.pdf
    • http://www.gorillawalker.com/the-kingdoms-of-israel-and-judah-in-the-eighth-and.pdf
    • http://www.gorillawalker.com/beer.pdf
    • http://www.gorillawalker.com/the-confusion-of-christendom.pdf
    • http://www.gorillawalker.com/design-of-computers-and-other-complex-digital-devices.pdf
    • http://www.gorillawalker.com/key-concepts-in-management-palgrave-key-concepts.pdf
    • http://www.gorillawalker.com/snmp-snmpv2-and-rmon-practical-network-management-2nd-edition.pdf
    • http://www.gorillawalker.com/neuroplastic-transformation-workbook.pdf
    • http://www.gorillawalker.com/inorganic-reactions-and-methods-formation-of-ceramics-volume-18.pdf
    • http://www.gorillawalker.com/materials-science-and-engineering-a-first-course.pdf
    • http://www.gorillawalker.com/harvard-medical-school-hypertension-controlling-the-silent-killer-harvard-medical.pdf
    • http://www.gorillawalker.com/bookstore-sales-by-mail.pdf
    • http://www.gorillawalker.com/lego-mindstorms-nxt-2-0-the-king-146-s-treasure.pdf
    • http://www.gorillawalker.com/d.pdf
    • http://www.gorillawalker.com/lars-gyllensten-world-authors.pdf
    • http://www.gorillawalker.com/american-cinema-of-the-1950s-themes-and-variations-screen-decades.pdf
    • http://www.gorillawalker.com/complete-bibliography-of-fencing-and-duelling.pdf
    • http://www.gorillawalker.com/the-top-200-websites-on-e-commerce-illustra-guides.pdf
    • http://www.gorillawalker.com/geology-and-geochemistry-of-oil-and-gas-volume-52-developments.pdf
    • http://www.gorillawalker.com/packing-for-mars-the-curious-science-of-life-in-the.pdf
    • http://www.gorillawalker.com/tardive-dyskinesia-and-neuroleptics-from-dogma-to-reason-clinical-insights.pdf
    • http://www.gorillawalker.com/sidewise-in-time-and-other-scientific-adventures.pdf
    • http://www.gorillawalker.com/education-and-labour-party-ideologies-1900-2001and-beyond-woburn-education.pdf
    • http://www.gorillawalker.com/michelle-obama-an-american-story.pdf
    • http://www.gorillawalker.com/enzo-ferrari-s-secret-war.pdf
    • http://www.gorillawalker.com/silk.pdf
    • http://www.gorillawalker.com/glencairn-dumfriesshire-the-annals-of-an-inland-parish.pdf
    • http://www.gorillawalker.com/athletics-olympic-sports.pdf
    • http://www.gorillawalker.com/the-graphic-arts-of-g
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.