Malicious PDF — malware analysis report

Static analysis result for SHA-256 932e9118e8d356eb…

MALICIOUS

PDF

48.3 KB Created: 2018-12-15 08:52:26 +03:00 Authoring application: QuarkXPress¢â: LaserWriter 8 KH-8.7.1 (via Acrobat Distiller 4.05 for Macintosh)
MD5: a50561c528061be19c702f26fb7ca6d5 SHA-1: 6f28b7426e8670f6d3806367e74b7f7f07b3a4f4 SHA-256: 932e9118e8d356eb9f1e1fd0565e8cca8ccb49478f90d31a23dd9b4819aa81ad
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files on the domain www.gorillawalker.com. This suggests a link farm or content distribution strategy. The ML classifier also flagged the PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8509

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/religious-fundamentalism-in-the-contemporary-world-critical-social-and-political.pdf
    • http://www.gorillawalker.com/in-the-know-in-mexico-central-america-the-indispensable-guide.pdf
    • http://www.gorillawalker.com/archiv-for-mathematik-og-naturvidenskab-volume-5-danish-edition.pdf
    • http://www.gorillawalker.com/bolt-action-armies-of-the-soviet-union.pdf
    • http://www.gorillawalker.com/the-cook-s-illustrated-cookbook-2-000-recipes-from-20.pdf
    • http://www.gorillawalker.com/clinical-trials-in-cancer-principles-and-practice-oxford-medical-publications.pdf
    • http://www.gorillawalker.com/so-not-a-cowboy.pdf
    • http://www.gorillawalker.com/css-detective-guide-tricks-for-solving-tough-css-mysteries-the.pdf
    • http://www.gorillawalker.com/el-orinal-del-pirata-spanish-edition.pdf
    • http://www.gorillawalker.com/estoppel-by-conduct-and-election.pdf
    • http://www.gorillawalker.com/introduction-to-applied-quantum-chemistry.pdf
    • http://www.gorillawalker.com/party-of-the-people-a-history-of-the-democrats.pdf
    • http://www.gorillawalker.com/memorials-in-berlin-and-buenos-aires-balancing-memory-architecture-and.pdf
    • http://www.gorillawalker.com/problem-solving-strategies-reproducible-grade-4.pdf
    • http://www.gorillawalker.com/tr-bner-s-oriental-series-racial-synthesis-in-hindu-culture.pdf
    • http://www.gorillawalker.com/animal-crossing-new-leaf-prima-official-game-guide-prima-official.pdf
    • http://www.gorillawalker.com/ketogenic-diet-ketosis-for-diabetes-lower-your-blood-sugar-and.pdf
    • http://www.gorillawalker.com/el-method-overcoming-shyness-fear-of-public-speaking-insecurity-low.pdf
    • http://www.gorillawalker.com/trekking-in-ladakh.pdf
    • http://www.gorillawalker.com/cantico-del-sol-di-francesco-d-assisi-s-4-2nd.pdf
    • http://www.gorillawalker.com/teacher-training-smart-pages-with-cd-rom-complete-training-materials.pdf
    • http://www.gorillawalker.com/insecure-gulf-the-end-of-certainty-and-the-transition-to.pdf
    • http://www.gorillawalker.com/how-to-stage-a-play-make-a-fortune-win-a.pdf
    • http://www.gorillawalker.com/the-gardens-of-democracy-a-new-american-story-of-citizenship.pdf
    • http://www.gorillawalker.com/walt-disney-world-universal-orlando-also-includes-seaworld-and-central.pdf
    • http://www.gorillawalker.com/dk-readers-atlantis-the-lost-city-level-4-proficient-readers.pdf
    • http://www.gorillawalker.com/applikation-eines-trainingsprogramms-an-konzentrationsauffalligen-vorschulkindern-in-verbindung-mit-imaginativen.pdf
    • http://www.gorillawalker.com/transformation-of-organometallics-into-common-and-exotic-materials-design-and.pdf
    • http://www.gorillawalker.com/la-fiesta-de-jesus-5-la-eucaristia-es-una-fiesta.pdf
    • http://www.gorillawalker.com/mi-libro-de-cocina-vegana-cocina-natural-spanish-edition.pdf
    • http://www.gorillawalker.com/therapeutic-counseling-and-psychotherapy-6th-edition.pdf
    • http://www.gorillawalker.com/brit-volume-2-awol.pdf
    • http://www.gorillawalker.com/shadow-and-light-shadow-light.pdf
    • http://www.gorillawalker.com/explicatio-viaggio-verso-le-origini-volume-7-italian-edition.pdf
    • http://www.gorillawalker.com/german-shepherds-2016-engagement.pdf
    • http://www.gorillawalker.com/facilitating-literacy-using-experience-books-a-case-study-of-two.pdf
    • http://www.gorillawalker.com/the-gorge.pdf
    • http://www.gorillawalker.com/grammar-writing-student-textbook-grade-4-2014.pdf
    • http://www.gorillawalker.com/a-literary-history-of-persia.pdf
    • http://www.gorillawalker.com/q-a-questions-and-answers-for-the-private-pilot-s.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.