Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bb9fadf98328df5…

MALICIOUS

PDF

39.6 KB Created: 2018-11-30 20:08:54 +03:00 Authoring application: FrameMaker 7.0 (via Acrobat Distiller 7.0 (Windows))
MD5: 0bee9eb0faf5f9a4e1576b7cef8bb662 SHA-1: 19526a4d7fd669ec5d5be4d87a86af5221391f1b SHA-256: 9bb9fadf98328df5ca715ea88e8fec40f24c0fd27ce616b0abe3cae6285f117f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary attack pattern appears to be a link farm designed to direct users to a high volume of content on the 'gorillawalker.com' domain, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/introduction-to-reactive-gas-dynamics.pdf
    • http://www.gorillawalker.com/jewish-grandmothers.pdf
    • http://www.gorillawalker.com/virtual-homelands-indian-immigrants-and-online-cultures-in-the-united.pdf
    • http://www.gorillawalker.com/the-paper-cowboy.pdf
    • http://www.gorillawalker.com/the-magic-of-the-ballet-gift-set.pdf
    • http://www.gorillawalker.com/the-world-through-a-monocle-the-new-yorker-at-midcentury.pdf
    • http://www.gorillawalker.com/haskell-w-harr-drum-method-book-one-for-band-and.pdf
    • http://www.gorillawalker.com/book-sidekick-frostbite-a-vampire-academy-novel-unofficial-kindle-edition.pdf
    • http://www.gorillawalker.com/wedding-performer-complete-piano-collection-44-solos-for-ceremonies-and.pdf
    • http://www.gorillawalker.com/the-encyclopedia-of-mummies.pdf
    • http://www.gorillawalker.com/yankees-and-rebels-the-civil-war-kindle-edition.pdf
    • http://www.gorillawalker.com/the-funk-wag-from-a-to-z-menil-collection.pdf
    • http://www.gorillawalker.com/barcelona-m-inspira-catalan-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/beijing-olympic-games-in-primary-school-readers-chinese-edition.pdf
    • http://www.gorillawalker.com/human-trafficking-prices-and-statistics-of-the-modern-day-slave.pdf
    • http://www.gorillawalker.com/the-mysteries-of-harris-burdick.pdf
    • http://www.gorillawalker.com/cosas-que-puedes-pensar-las.pdf
    • http://www.gorillawalker.com/conquer-your-fears-and-phobias-for-teens-how-to-build.pdf
    • http://www.gorillawalker.com/cookin-crunk-eating-vegan-in-the-dirty-south.pdf
    • http://www.gorillawalker.com/jasper-national-park-canadian-rockies.pdf
    • http://www.gorillawalker.com/wie-du-deine-pr.pdf
    • http://www.gorillawalker.com/i-was-born-a-slave-an-anthology-of-classic-slave.pdf
    • http://www.gorillawalker.com/sonata-in-c-k-545-complete-alfred-masterwork-edition.pdf
    • http://www.gorillawalker.com/periodistas-sometidos-spanish-edition.pdf
    • http://www.gorillawalker.com/nicky-s-jazz-christmas.pdf
    • http://www.gorillawalker.com/individuals-with-profound-disabilities-instructional-and-assistive-strategies.pdf
    • http://www.gorillawalker.com/the-algernon-files.pdf
    • http://www.gorillawalker.com/armageddon-s-children-the-genesis-of-shannara-book-1.pdf
    • http://www.gorillawalker.com/forgotten-realms-15.pdf
    • http://www.gorillawalker.com/mania-mania-mania.pdf
    • http://www.gorillawalker.com/times-food-and-nightlife-guide-delhi-2011.pdf
    • http://www.gorillawalker.com/letters-from-the-field-1925-1975.pdf
    • http://www.gorillawalker.com/gregg-s-commerce-of-the-prairies-or-the-journal-of.pdf
    • http://www.gorillawalker.com/java-concepts.pdf
    • http://www.gorillawalker.com/treasury-of-french-love-poems-quotations-and-proverbs-treasury-of.pdf
    • http://www.gorillawalker.com/12-smart-choices-for-finding-the-right-guy.pdf
    • http://www.gorillawalker.com/spencerian-penmanship-theory-book.pdf
    • http://www.gorillawalker.com/ralph-lauren-famous-fashion-designers.pdf
    • http://www.gorillawalker.com/1001-tips-for-living-well-with-diabetes.pdf
    • http://www.gorillawalker.com/love-at-first-roar-grayslake-volume-4.pdf
    • http://www.gorillawalker.com/book-sidekick-frostbite-a-vampire-academy-novel
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.