Malicious PDF — malware analysis report

Static analysis result for SHA-256 939367532a600252…

MALICIOUS

PDF

43.7 KB Created: 2018-11-30 20:30:38 +03:00 Authoring application: FrameMaker 7.2 (via Acrobat Distiller 7.0 (Windows))
MD5: da2b0d2100017b1e65f84b5f3ecba52d SHA-1: 99b1e55746512babe1c103a7475daeb093882b10 SHA-256: 939367532a60025206d941d30c54dc7a2090262d500cfb580678d78c7b0c5d81
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly for SEO spam or to distribute further malware. The primary IOCs are the URLs hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/special-clinic-special-treatment-of-prostate-disease.pdf
    • http://www.gorillawalker.com/procurement-with-sap-mm-practical-guide.pdf
    • http://www.gorillawalker.com/pre-algebra-studentworks-plus-cd-rom.pdf
    • http://www.gorillawalker.com/research-skills-for-students-transferable-learning-skills.pdf
    • http://www.gorillawalker.com/the-manual-of-manufacturing-meat-quality.pdf
    • http://www.gorillawalker.com/diary-of-a-6th-grade-ninja-7-scavengers.pdf
    • http://www.gorillawalker.com/gran-turismo-prima-s-official-strategy-guide.pdf
    • http://www.gorillawalker.com/complicated-creatures-part-one-in-a-romantic-suspense-series-volume.pdf
    • http://www.gorillawalker.com/popular-science-1944-october.pdf
    • http://www.gorillawalker.com/benjamin-banneker-astronomer-and-mathematician-african-american-biographies-enslow.pdf
    • http://www.gorillawalker.com/understanding-aging-a-short-tour-social-perspectives-of-aging.pdf
    • http://www.gorillawalker.com/secure-target.pdf
    • http://www.gorillawalker.com/genealogical-record-of-the-descendants-of-david-sage-a-native.pdf
    • http://www.gorillawalker.com/aristotle-s-nicomachean-ethics.pdf
    • http://www.gorillawalker.com/modoc-the-true-story-of-the-greatest-elephant-that-ever.pdf
    • http://www.gorillawalker.com/crc-handbook-of-phase-equilibria-and-thermodynamic-data-of-polymer.pdf
    • http://www.gorillawalker.com/if-he-s-sinful-wherlocke-no-2.pdf
    • http://www.gorillawalker.com/the-ghost-of-mistletoe-mary-ghost-of-granny-apples.pdf
    • http://www.gorillawalker.com/ti-arm-peripherals-programming-and-interfacing-using-c-language-for.pdf
    • http://www.gorillawalker.com/mgh-cardiology-board-review.pdf
    • http://www.gorillawalker.com/marketing-yourself-and-your-career-personal-growth-and-development-collection.pdf
    • http://www.gorillawalker.com/the-wildshire-episode-one-the-back-of-mag.pdf
    • http://www.gorillawalker.com/wales-epic-views-of-a-small-country.pdf
    • http://www.gorillawalker.com/proportional-assist-ventilation-guidelines-standards-for-using-pavtm-kindle-edition.pdf
    • http://www.gorillawalker.com/a-translation-from-french-into-english-of-camille-mauclair-s.pdf
    • http://www.gorillawalker.com/mental-toughness-training-for-sports-achieving-athletic-excellence-plume.pdf
    • http://www.gorillawalker.com/smart-biosensor-technology-optical-science-and-engineering.pdf
    • http://www.gorillawalker.com/incestuous-families-an-ecological-approach-to-understanding-and-treatment-norton.pdf
    • http://www.gorillawalker.com/statistical-size-distributions-in-economics-and-actuarial-sciences.pdf
    • http://www.gorillawalker.com/aerosol-optical-depth-model-assessment-with-high-resolution-multiple-angle.pdf
    • http://www.gorillawalker.com/the-national-debit-second-edition-how-the-post-gold-standard.pdf
    • http://www.gorillawalker.com/moon-called-patricia-briggs-mercy-thompson.pdf
    • http://www.gorillawalker.com/history-and-philosophy-of-modern-mathematics-volume-xi-minnesota-studies.pdf
    • http://www.gorillawalker.com/jamaican-american-thug-drama-the-jamaican-american-thug-drama-saga.pdf
    • http://www.gorillawalker.com/horizons-6th-edition.pdf
    • http://www.gorillawalker.com/piping-and-pipelines-assessment-guide-stationary-equipment-assessment.pdf
    • http://www.gorillawalker.com/the-outdoor-photographer-s-bible-doubleday-outdoor-bibles.pdf
    • http://www.gorillawalker.com/vitamin-d-oxidative-stress-immunity-and-aging-oxidative-stress-and.pdf
    • http://www.gorillawalker.com/new-songs-from-a-jade-terrace.pdf
    • http://www.gorillawalker.com/japan-a-bilingual-map.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.