Malicious PDF — malware analysis report

Static analysis result for SHA-256 933ec9dc9c9f113f…

MALICIOUS

PDF

33.7 KB Created: 2019-12-14 00:07:07 +03:00 Authoring application: TeX (via pdfTeX-1.40.17)
MD5: 269d39eae98c395ec473f4f4bcfa4844 SHA-1: 66e402ac681ef3a911dd99216012b9270d1a5154 SHA-256: 933ec9dc9c9f113f5486673d76166ee909510a8f2dd5fb46b84adcb1595f2525
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/avenir-eclectia-vol-1.pdf
    • http://www.gorillawalker.com/solo-flight-a-bipolar-odyssey.pdf
    • http://www.gorillawalker.com/language-literacy-and-children-with-special-needs-the-pippin-teacher.pdf
    • http://www.gorillawalker.com/protein-transport-into-the-endoplasmic-reticulum-molecular-biology-intelligence-unit.pdf
    • http://www.gorillawalker.com/ex-mas.pdf
    • http://www.gorillawalker.com/owens-river-gorge-climbs-9th-edition.pdf
    • http://www.gorillawalker.com/sugar-free-grilling-recipes-and-sugar-free-raw-recipes-2.pdf
    • http://www.gorillawalker.com/the-intelligent-design-of-creation-kindle-edition.pdf
    • http://www.gorillawalker.com/the-masquerading-cowboy.pdf
    • http://www.gorillawalker.com/women-s-gymnastics-ep-sport-series.pdf
    • http://www.gorillawalker.com/the-compendium-music-of-ren-descartes-early-english-responses-musical.pdf
    • http://www.gorillawalker.com/the-assassins-of-rome-the-roman-mysteries-book-v.pdf
    • http://www.gorillawalker.com/high-resolution-nuclear-magnetic-resonance-advanced-chemistry.pdf
    • http://www.gorillawalker.com/the-content-of-the-form-narrative-discourse-and-historical-representation.pdf
    • http://www.gorillawalker.com/mouth-actions-in-sign-languages-an-empirical-study-of-irish.pdf
    • http://www.gorillawalker.com/boom-a-wrestling-story-kindle-edition.pdf
    • http://www.gorillawalker.com/skin-cancer-facts-prevention-early-detection.pdf
    • http://www.gorillawalker.com/information-security-based-on-iso-27001-iso-27002-a-management.pdf
    • http://www.gorillawalker.com/mosby-s-manual-of-diagnostic-and-laboratory-tests-pageburst-e.pdf
    • http://www.gorillawalker.com/political-outsiders-in-swedish-history-1848-1932.pdf
    • http://www.gorillawalker.com/computer-shorthand-skill-building-and-realtime-transcription-3rd-edition.pdf
    • http://www.gorillawalker.com/le-mans-55-the-crash-that-changed-the-face-of.pdf
    • http://www.gorillawalker.com/orchid-biotechnology.pdf
    • http://www.gorillawalker.com/101-television-troubles.pdf
    • http://www.gorillawalker.com/dirty-bertie.pdf
    • http://www.gorillawalker.com/the-savage-way-successfully-navigating-the-waves-of-business-and.pdf
    • http://www.gorillawalker.com/the-bobby-fischer-i-knew-and-other-stories.pdf
    • http://www.gorillawalker.com/consume-me-ravage-mc-3-volume-3.pdf
    • http://www.gorillawalker.com/los-hombres-son-de-marte-las-mujeres-son-de-venus.pdf
    • http://www.gorillawalker.com/cats-read-about.pdf
    • http://www.gorillawalker.com/l-invasion-de-paris-1000-harcover-books-in-slipcover-english.pdf
    • http://www.gorillawalker.com/a-primary-source-history-of-u-s-independence.pdf
    • http://www.gorillawalker.com/anales-de-construcciones-civiles-minas-e-industrias-del-peru-volumes.pdf
    • http://www.gorillawalker.com/person-in-the-world-introduction-to-the-philosophy-of-edith.pdf
    • http://www.gorillawalker.com/juvenile-law-by-siegel-larry-j-tracy-paul-e-prentice.pdf
    • http://www.gorillawalker.com/social-anarchism-or-lifestyle-anarchism-an-unbridgeable-chasm.pdf
    • http://www.gorillawalker.com/paloma-solitaria-lonesome-dove-spanish-edition.pdf
    • http://www.gorillawalker.com/streetsmart-nyc-map-by-vandam-guide-and-map-to-nyc.pdf
    • http://www.gorillawalker.com/product-design-with-plastics-a-practical-manual.pdf
    • http://www.gorillawalker.com/photographing-waterdrops-exploring-macro-worlds-with-harold-davis.pdf
    • http://www.gorillawalker.com/high-resolution-n
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.