Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3667c8daf0808ce…

MALICIOUS

PDF

47.7 KB Created: 2018-11-30 20:31:49 +03:00 Authoring application: - (via Apache FOP Version 0.93) First seen: 2019-01-12
MD5: 0ba2d2f8e378163f714a9c4ad56302f9 SHA-1: 53de2168d2da7e7691c39bd0de2f8f8d016cab5c SHA-256: a3667c8daf0808ce6605ae2ad89b4e38454a1c0a392bbe11bc618402b78ab1c6
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains an external URI pointing to a PDF file hosted on www.gorillawalker.com. The ML classifier also flagged this PDF as malicious. The document body was not sufficiently readable to determine a specific lure, but the presence of the external link suggests a download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8263

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/boys-of-86-the-untold-story-of-west-ham-united.pdf In PDF document text
    • http://www.gorillawalker.com/the-grand-duke.pdfIn PDF document text
    • http://www.gorillawalker.com/a-dictionary-of-the-bible-2nd-edition-oxford-paperback-reference.pdfIn PDF document text
    • http://www.gorillawalker.com/strength-and-materials-supplement-selections-from-mechanical-engineering-design-college.pdfIn PDF document text
    • http://www.gorillawalker.com/theory-and-research-on-small-groups-social-psychological-applications-to.pdfIn PDF document text
    • http://www.gorillawalker.com/coraz-n-de-campe-n-spanish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/streams-of-silver-the-icewind-dale-trilogy-part-2-forgotten.pdfIn PDF document text
    • http://www.gorillawalker.com/ferry-crossing-world-literature-in-translation.pdfIn PDF document text
    • http://www.gorillawalker.com/peeps-at-many-lands-belgium.pdfIn PDF document text
    • http://www.gorillawalker.com/thread-painting-made-easy.pdfIn PDF document text
    • http://www.gorillawalker.com/grammar-of-the-bengali-language-literary-and-colloquial.pdfIn PDF document text
    • http://www.gorillawalker.com/kjv-standard-lesson-commentary-large-print-2010-2011.pdfIn PDF document text
    • http://www.gorillawalker.com/explorations-adventures-in-equatorial-africa-with-accounts-of-the-manners.pdfIn PDF document text
    • http://www.gorillawalker.com/nya-testamentet-swedish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/the-philosophical-origins-of-modern-contract-doctrine-clarendon-law.pdfIn PDF document text
    • http://www.gorillawalker.com/survey-of-3d-printing-in-the-library.pdfIn PDF document text
    • http://www.gorillawalker.com/estate-planning-for-the-single-daddy-a-simple-guide-to.pdfIn PDF document text
    • http://www.gorillawalker.com/concerto-for-oboe-and-strings-freely-arranged-by-a-benjamin.pdfIn PDF document text
    • http://www.gorillawalker.com/canadian-pharmacy-exams-2nd-edition-november-2014-pharmacist-evaluating-exam.pdfIn PDF document text
    • http://www.gorillawalker.com/sephardism-spanish-jewish-history-and-the-modern-literary-imagination-stanford.pdfIn PDF document text
    • http://www.gorillawalker.com/evo-uprising-the-first-series-book-2.pdfIn PDF document text
    • http://www.gorillawalker.com/pathology-parasitology-for-veterinary-technicians-veterinary-technology.pdfIn PDF document text
    • http://www.gorillawalker.com/early-warning-timely-response-a-guide-to-safe-schools.pdfIn PDF document text
    • http://www.gorillawalker.com/hoi-an-vietnam-city-travel-guide-2014-attractions-restaurants-and.pdfIn PDF document text
    • http://www.gorillawalker.com/world-literature-in-review-other-romance-languages-bibliography-an-article.pdfIn PDF document text
    • http://www.gorillawalker.com/the-first-socialist-society-a-history-of-the-soviet-union.pdfIn PDF document text
    • http://www.gorillawalker.com/the-glorious-new-covenant-ministry-its-basis-and-practice.pdfIn PDF document text
    • http://www.gorillawalker.com/kingdom-of-fear-loathsome-secrets-of-a-star-crossed-child.pdfIn PDF document text
    • http://www.gorillawalker.com/integration-of-data-mining-in-business-intelligence-systems-advances-in.pdfIn PDF document text
    • http://www.gorillawalker.com/mila-18.pdfIn PDF document text
    • http://www.gorillawalker.com/biscuit-cookie-and-cracker-manufacturing-manual-2-doughs-woodhead-publishing.pdfIn PDF document text
    • http://www.gorillawalker.com/an-annotated-bibliography-for-health-occupations-a-guide-for-teachers.pdfIn PDF document text
    • http://www.gorillawalker.com/integrals-series-v1-elem-fun.pdfIn PDF document text
    • http://www.gorillawalker.com/ceramic-materials-research-proceedings-of-symposium-on-ceramic-materials-research.pdfIn PDF document text
    • http://www.gorillawalker.com/ceramic-coin-banks-identification-value-guide.pdfIn PDF document text
    • http://www.gorillawalker.com/the-chronicles-of-steve.pdfIn PDF document text
    • http://www.gorillawalker.com/theories-of-the-capitalist-economy.pdfIn PDF document text
    • http://www.gorillawalker.com/yeohlee-work.pdfIn PDF document text
    • http://www.gorillawalker.com/if-the-irish-ran-the-world-montserrat-1630-1730.pdfIn PDF document text
    • http://www.gorillawalker.com/earth-anchors-second-edition.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.