Malicious PDF — malware analysis report

Static analysis result for SHA-256 892c5f445e07743e…

MALICIOUS

PDF

36.6 KB Created: 2019-12-18 16:53:32 +03:00 Authoring application: AH XSL Formatter V6.1 MR6 for Windows (x64) : 6.1.11.18624 (via Antenna House PDF Output Library 6.1.610 (Windows (x64)))
MD5: 42054c9d9e46e4a526d5ca04d3a4f7f3 SHA-1: 39df84d04b5be0c67cd282480375bd9a2ff53bc6 SHA-256: 892c5f445e07743e56fb32d199065d9433528049ac3f7c668c809f12f8bbd74f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files on the domain www.gorillawalker.com. This suggests a link farm or distribution mechanism. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file. No scripts were extracted, and the document body was truncated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8218

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/3-x-3-eyes-vol-6-key-to-the-sacred.pdf
    • http://www.gorillawalker.com/basic-chemical-thermodynamics-fifth-edition.pdf
    • http://www.gorillawalker.com/the-sf-compact-2009-mla-update-edition-2nd-edition-english.pdf
    • http://www.gorillawalker.com/michael-jackson-s-malt-whisky-companion.pdf
    • http://www.gorillawalker.com/grey-matter-a-science-fiction-fantasy-digest-kindle-edition.pdf
    • http://www.gorillawalker.com/how-to-build-the-gloucester-light-dory-a-classic-in.pdf
    • http://www.gorillawalker.com/the-functions-of-social-conflict-an-examination-of-the-concept.pdf
    • http://www.gorillawalker.com/auditing-assurance-services-with-acl-software-student-cd-rom.pdf
    • http://www.gorillawalker.com/the-truth-of-memoir-how-to-write-about-yourself-and.pdf
    • http://www.gorillawalker.com/community-corrections-probation-parole-and-intermediate-sanctions-readings-in-crime.pdf
    • http://www.gorillawalker.com/introduction-to-computers-and-information-technology-student-workbook.pdf
    • http://www.gorillawalker.com/arsenic-treated-wood-barks-but-bite-is-questioned-safety-techniques.pdf
    • http://www.gorillawalker.com/queens-ny-street-map.pdf
    • http://www.gorillawalker.com/marine-biology-castro-8th-eigth-edition-nasta-hardcover-reinforced-high.pdf
    • http://www.gorillawalker.com/field-methods-for-academic-research-interviews-focus-groups-and-questionnaires.pdf
    • http://www.gorillawalker.com/scale-relativity-and-fractal-space-time-a-new-approach-to.pdf
    • http://www.gorillawalker.com/la-renegada-la-esp-a-traidora-2-spanish-edition.pdf
    • http://www.gorillawalker.com/el-peque-o-gran-libro-del-tarot-compatibilidades-de-los.pdf
    • http://www.gorillawalker.com/golf-by-design-how-to-lower-your-score-by-reading.pdf
    • http://www.gorillawalker.com/tabla-de-calorias-spanish-edition.pdf
    • http://www.gorillawalker.com/morgenstern-josiah-trenchard-part-two-space-navy-book-2-kindle.pdf
    • http://www.gorillawalker.com/essays-in-theology-of-culture.pdf
    • http://www.gorillawalker.com/chemistry-student-solutions-manual-the-molecular-nature-of-matter.pdf
    • http://www.gorillawalker.com/advances-in-horticulture-v-2-propagation-and-rootstocks.pdf
    • http://www.gorillawalker.com/comics-sketchbooks-the-private-worlds-of-today-s-most-creative.pdf
    • http://www.gorillawalker.com/femtosecond-beam-science.pdf
    • http://www.gorillawalker.com/manual-del-companero-partner-manual-masoneria-spanish-edition.pdf
    • http://www.gorillawalker.com/brain-stroke-and-kidney-contributions-to-nephrology-vol-179.pdf
    • http://www.gorillawalker.com/thinking-identities-ethnicity-racism-and-culture-explorations-in-sociology.pdf
    • http://www.gorillawalker.com/the-stonehenge-legacy-a-thriller.pdf
    • http://www.gorillawalker.com/on-positively-preserving-finite-volume-schemes-for-compressible-euler-equations.pdf
    • http://www.gorillawalker.com/indian-image-in-english-fiction.pdf
    • http://www.gorillawalker.com/the-author-of-the-apocalypse-a-review-of-the-prevailing.pdf
    • http://www.gorillawalker.com/spanish-vocabulary.pdf
    • http://www.gorillawalker.com/tchaikovsky-the-nutcracker-suite-op-71a-piano-duet-play-along.pdf
    • http://www.gorillawalker.com/backyard-chickens-the-beginner-s-guide-to-raising-and-caring.pdf
    • http://www.gorillawalker.com/miguel-vicente-pata-caliente-hot-footed-miguel-vicente-spanish-edition.pdf
    • http://www.gorillawalker.com/electroencephalogram-a-medical-dictionary-bibliography-and-annotated-research-guide-to.pdf
    • http://www.gorillawalker.com/behind-a-mask-the-unknown-thrillers-of-louisa-may-alcott.pdf
    • http://www.gorillawalker.com/neurobiology-and-mental-health-clinical-practice-new-directions-new-challenges.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.