Malicious PDF — malware analysis report

Static analysis result for SHA-256 a39c58982d6911f9…

MALICIOUS

PDF

33.3 KB Created: 2020-01-17 19:20:54 +03:00 Authoring application: Adobe InDesign CS4 (6.0.6) (via Mac OS X 10.9.1 Quartz PDFContext)
MD5: c5f4a86b5538272db93442698118389b SHA-1: d3da865448b9d325e4fd1b28dae62a3228f053a8 SHA-256: a39c58982d6911f9b7a468e17bcd43a87c25f5fe2fab2a85522fa759c3658585
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain www.gorillawalker.com. This is indicative of a link farm, likely used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/revolts-barracuda-vol-4.pdf
    • http://www.gorillawalker.com/haydn-mass-in-time-of-war.pdf
    • http://www.gorillawalker.com/harry-hopkins-ally-of-the-poor-and-defender-of-democracy.pdf
    • http://www.gorillawalker.com/coaching-para-el-creativo-que-hay-dentro-de-ti-spanish.pdf
    • http://www.gorillawalker.com/mathematical-models-of-chemical-reactions-theory-and-applications-of-deterministic.pdf
    • http://www.gorillawalker.com/gregory-is-grouchy-and-other-really-good-reasons-to-be.pdf
    • http://www.gorillawalker.com/city-at-the-end-of-time.pdf
    • http://www.gorillawalker.com/a-colonial-plantation-cookbook-the-receipt-book-of-harriott-pinckney.pdf
    • http://www.gorillawalker.com/marshal-of-victory-vol-2-the-wwii-memoirs-of-soviet.pdf
    • http://www.gorillawalker.com/the-end-of-apartheid-causes-consequences.pdf
    • http://www.gorillawalker.com/technic-is-fun-hirschberg.pdf
    • http://www.gorillawalker.com/nancy-loves-sluggo-complete-dailies-1949-1951.pdf
    • http://www.gorillawalker.com/reference-manual-for-magnetic-resonance-safety-implants-and-devices-2011.pdf
    • http://www.gorillawalker.com/health-and-illness-in-a-changing-society.pdf
    • http://www.gorillawalker.com/unassailable-the-case-files-of-dr-matilda-schmidt-paranormal-psychologist.pdf
    • http://www.gorillawalker.com/the-standing-stone-an-adventure-for-7th-level-characters-dungeons.pdf
    • http://www.gorillawalker.com/gay-day-the-golden-age-of-the-christopher-street-parade.pdf
    • http://www.gorillawalker.com/land-piety-peoplehood-the-establishment-of-mennonite-communities-in-america.pdf
    • http://www.gorillawalker.com/hayate-the-combat-butler-vol-24.pdf
    • http://www.gorillawalker.com/a-quick-quiz-film-pub-quiz-kindle-edition.pdf
    • http://www.gorillawalker.com/her-wilde-bodyguards-wilde-nevada-5-siren-publishing-menage-everlasting.pdf
    • http://www.gorillawalker.com/conde-nast-johansens-recommended-hotels-and-spas-europe-and-the.pdf
    • http://www.gorillawalker.com/chips-and-cheese-and-nana-s-knees-what-is-alliteration.pdf
    • http://www.gorillawalker.com/peyote-and-other-psychoactive-cacti.pdf
    • http://www.gorillawalker.com/thomas-goes-to-the-circus-toddler-board-books.pdf
    • http://www.gorillawalker.com/attention-deficit-disorder-the-unfocused-mind-in-children-and-adults.pdf
    • http://www.gorillawalker.com/richard-wagner-s-zurich-the-muse-of-place-studies-in.pdf
    • http://www.gorillawalker.com/american-legends-the-life-of-betsy-ross-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/1000-best-tips-for-adhd-expert-answers-and-bright-advice.pdf
    • http://www.gorillawalker.com/the-postmodern-brain-advances-in-consciousness-research.pdf
    • http://www.gorillawalker.com/a-thousand-years-of-travel-in-old-hungary.pdf
    • http://www.gorillawalker.com/persistent-love-a-novella-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/research-successful-approaches.pdf
    • http://www.gorillawalker.com/john-coltrane-and-black-america-s-quest-for-freedom-spirituality.pdf
    • http://www.gorillawalker.com/official-assassin-winston-churchill-s-sas-hit-team.pdf
    • http://www.gorillawalker.com/turning-pain-into-power.pdf
    • http://www.gorillawalker.com/grounded-in-eire-the-story-of-two-raf-fliers-interned.pdf
    • http://www.gorillawalker.com/poetica-erotica-kindle-edition.pdf
    • http://www.gorillawalker.com/wolverine-logan.pdf
    • http://www.gorillawalker.com/write-to-the-top-writing-for-corporate-success-newly-revised.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.