Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ce3b22175158ba2…

MALICIOUS

PDF

44.8 KB Created: 2018-11-15 02:41:24 +03:00 Authoring application: ScanSnap Manager (via Acrobat Distiller 10.1.7 (Windows))
MD5: b86874aade6112c1c0136aafdca487ab SHA-1: 3dcd9e4784fa243cfb6e4967108be231f93518d4 SHA-256: 8ce3b22175158ba2a752ff824e1aa18fd3553178a4a1ae276ca2d1a61a962b4f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF documents hosted on www.gorillawalker.com. This behavior is indicative of a link farm, likely intended for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/simplicial-objects-in-algebraic-topology-chicago-lectures-in-mathematics.pdf
    • http://www.gorillawalker.com/acute-and-critical-care-in-adult-nursing-transforming-nursing-practice.pdf
    • http://www.gorillawalker.com/hosoi-my-life-as-a-skateboarder-junkie-inmate-pastor.pdf
    • http://www.gorillawalker.com/chu-ci-jiao-shi-mandarin-chinese-edition.pdf
    • http://www.gorillawalker.com/shogunkenonakoudo-japanese-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/gaining-advantage-from-open-borders-an-active-space-approach-to.pdf
    • http://www.gorillawalker.com/music-as-cultural-practice-1800-1900-california-studies-in-19th.pdf
    • http://www.gorillawalker.com/fires-in-an-autumn-garden-short-stories-from-urdu-and.pdf
    • http://www.gorillawalker.com/food-lovers-guide-to-new-orleans-the-best-restaurants-markets.pdf
    • http://www.gorillawalker.com/pianos-inside-out-a-comprehensive-guide-to-piano-tuning-repairing.pdf
    • http://www.gorillawalker.com/holy-hell-lillian-byrd-crime-series-book-1.pdf
    • http://www.gorillawalker.com/fingering-mastery-scales-and-modes-for-the-violin-fingerboard.pdf
    • http://www.gorillawalker.com/travels-in-north-america-with-geological-observations-on-the-united.pdf
    • http://www.gorillawalker.com/para-adolecentes-y-padres-to-adolescents-and-parents-nuevo-estilo.pdf
    • http://www.gorillawalker.com/caribbean-caper-kindle-edition.pdf
    • http://www.gorillawalker.com/drafting-commercial-contracts-vocabulary-series-legal-study-e-guides.pdf
    • http://www.gorillawalker.com/sugar-free-freezer-recipes-and-raw-sugar-free-recipes-2.pdf
    • http://www.gorillawalker.com/reiki-esencial-masters-la-gu-a-m-s-completa-de.pdf
    • http://www.gorillawalker.com/seneca-s-troades-a-literary-introduction-with-text-translation-and.pdf
    • http://www.gorillawalker.com/algebra-and-trigonometry-4th-edition.pdf
    • http://www.gorillawalker.com/wild-rose-s-weaving.pdf
    • http://www.gorillawalker.com/accelerator-physics-example-problems-with-solutions.pdf
    • http://www.gorillawalker.com/achewood-the-great-outdoor-fight.pdf
    • http://www.gorillawalker.com/the-purple-doodle-book.pdf
    • http://www.gorillawalker.com/how-the-stock-market-works.pdf
    • http://www.gorillawalker.com/philosophy-of-karl-jaspers-the-library-of-living-philosophers.pdf
    • http://www.gorillawalker.com/deception-well-the-nanotech-succession-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/turning-mirrors-into-windows-teaching-the-best-short-films.pdf
    • http://www.gorillawalker.com/gnostic-alchemy-series-william-law-s-the-works-of-jacob.pdf
    • http://www.gorillawalker.com/the-new-mrs-lee-s-cookbook-nonya-cuisine.pdf
    • http://www.gorillawalker.com/the-grace-of-god-faith-to-receive-god-s-unlimited.pdf
    • http://www.gorillawalker.com/cocina-rapida-con-microondas-quick-kitchen-with-microwave-spanish-edition.pdf
    • http://www.gorillawalker.com/leading-the-way-darby-s-ranger-noel-dye.pdf
    • http://www.gorillawalker.com/los-poderes-m-gicos-de-la-biblia-spanish-edition.pdf
    • http://www.gorillawalker.com/oh-how-god-works-when-we-let-him.pdf
    • http://www.gorillawalker.com/forward-to-the-past-attitudes-charles-reinhart-on-ballet-dancing.pdf
    • http://www.gorillawalker.com/a-cross-cultural-dialogue-on-health-care-ethics.pdf
    • http://www.gorillawalker.com/first-person-preaching-bringing-new-life-to-biblical-stories.pdf
    • http://www.gorillawalker.com/the-art-of-cosmic-vision-practices-for-improving-your-eyesight.pdf
    • http://www.gorillawalker.com/humoral-factors-the-natural-immune-system.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.