Malicious PDF — malware analysis report

Static analysis result for SHA-256 984bfe05e430d416…

MALICIOUS

PDF

47.1 KB Created: 2019-03-16 14:05:40 +03:00 Authoring application: - (via Multivalent Merge)
MD5: a06ada633efccbc7bdac670659827870 SHA-1: 016f36f32958a2cbedca3159687c0c4dcd3df959 SHA-256: 984bfe05e430d41632d5fbe897958973b0bb3a0328396bee56e4b99ffaa9ed9e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a large number of embedded links to external PDF files hosted on www.gorillawalker.com. This suggests a link farm or a distribution point for malicious content. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8527

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/andrew-jackson-and-the-bank-war-norton-essays-in-american.pdf
    • http://www.gorillawalker.com/coombs-my-musical-journey.pdf
    • http://www.gorillawalker.com/california-legal-ethics-3rd-ed-american-casebook-series-and-other.pdf
    • http://www.gorillawalker.com/masters-servants-and-magistrates-in-britain-and-the-empire-1562.pdf
    • http://www.gorillawalker.com/pot-pies-yumminess-in-a-dish.pdf
    • http://www.gorillawalker.com/electric-automobiles-industry-and-government-issues.pdf
    • http://www.gorillawalker.com/big-and-little-poison-paul-and-lloyd-waner-baseball-brothers.pdf
    • http://www.gorillawalker.com/diario-de-los-literatos-de-espa-a-en-que-se.pdf
    • http://www.gorillawalker.com/the-angel-of-the-west-window-dedalus-european-classics.pdf
    • http://www.gorillawalker.com/aquariums-the-complete-guide-to-freshwater-and-saltwater-aquariums.pdf
    • http://www.gorillawalker.com/early-korea-the-samhan-period-in-korean-history.pdf
    • http://www.gorillawalker.com/cajuns-and-their-acadian-ancestors-a-young-reader-s-history.pdf
    • http://www.gorillawalker.com/pocket-rough-guide-istanbul-rough-guide-to.pdf
    • http://www.gorillawalker.com/canzoniere-fyfield-books.pdf
    • http://www.gorillawalker.com/bissell-v-spring-valley-tp-u-s-supreme-court-transcript.pdf
    • http://www.gorillawalker.com/napoleon-the-empress-and-the-artist-the-story-of-napoleon.pdf
    • http://www.gorillawalker.com/the-original-water-color-paintings-by-john-james-audubon-for.pdf
    • http://www.gorillawalker.com/college-bound-student-athlete-guide-to-men-s-lacrosse.pdf
    • http://www.gorillawalker.com/notes-from-the-underground-the-whittaker-chambers-ralph-de-toledano.pdf
    • http://www.gorillawalker.com/review-of-survey-report-willamette-river-and-tributaries-oregon-appendix.pdf
    • http://www.gorillawalker.com/a-guide-to-church-property-law-theological-constitutional-and-practical.pdf
    • http://www.gorillawalker.com/kennewick-man-perspectives-on-the-ancient-one-archaeology-indigenous-peoples.pdf
    • http://www.gorillawalker.com/a-companion-to-early-modern-women-s-writing.pdf
    • http://www.gorillawalker.com/board-a-sinking-ship-kindle-edition.pdf
    • http://www.gorillawalker.com/ancient-greece-interdisciplinary-thematic-unit.pdf
    • http://www.gorillawalker.com/advances-in-structural-engineering-mechanics-volume-one.pdf
    • http://www.gorillawalker.com/lpn-lvn-review-for-the-nclex-pn-medical-surgical-nursing.pdf
    • http://www.gorillawalker.com/two-for-the-show.pdf
    • http://www.gorillawalker.com/shaking-the-nickel-bush-the-little-britches-series.pdf
    • http://www.gorillawalker.com/nickel-a-pack.pdf
    • http://www.gorillawalker.com/edinburgh-sights-2011-a-travel-guide-to-the-top-30.pdf
    • http://www.gorillawalker.com/tarikh-i-akbari.pdf
    • http://www.gorillawalker.com/bared-to-you-a-crossfire-novel-book-1-unabridged-audible.pdf
    • http://www.gorillawalker.com/sight-word-poetry-pages-100-fill-in-the-blank-practice.pdf
    • http://www.gorillawalker.com/notes-for-friends.pdf
    • http://www.gorillawalker.com/population-patterns-what-factors-determine-the-location-and-growth-of.pdf
    • http://www.gorillawalker.com/american-wars-american-peace-notes-from-a-son-of-the.pdf
    • http://www.gorillawalker.com/scientology-the-cult-of-greed-kindle-edition.pdf
    • http://www.gorillawalker.com/ideas-behind-modern-chess-openings-black-batsford-chess-book.pdf
    • http://www.gorillawalker.com/teaching-lifetime-outdoor-pursuits.pdf
    • http://www.gorillawalker.com/big-and-little-poison-paul-and-lloyd-waner-ba
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.