Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7324a9f41d5a7b8…

MALICIOUS

PDF

42.2 KB Created: 2019-03-17 01:39:41 +03:00 Authoring application: - (via iText 2.1.0 (by lowagie.com)) First seen: 2021-06-28
MD5: cb9c1469260df5768f188b4b89d858d4 SHA-1: 0952d859db02f4c4b9714b0c9b6e03c4fee08ad8 SHA-256: a7324a9f41d5a7b834f93a6c459f12e2442a5cce696315737f6b455fd6f2ddab
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/muslims-in-india-since-1947-islamic-perspectives-on-inter-faith.pdf In PDF document text
    • http://www.gorillawalker.com/oncology-nursing-secrets-3e.pdfIn PDF document text
    • http://www.gorillawalker.com/sephira-ritter-der-zeit-3-das-herz-der-kriegerin-german.pdfIn PDF document text
    • http://www.gorillawalker.com/thomas-joshua-cooper-scattered-waters.pdfIn PDF document text
    • http://www.gorillawalker.com/wallpaper-city-guide-geneva.pdfIn PDF document text
    • http://www.gorillawalker.com/exploring-materials-creative-design-for-everyday-objects.pdfIn PDF document text
    • http://www.gorillawalker.com/vanguard-of-retrogression.pdfIn PDF document text
    • http://www.gorillawalker.com/reckless-road-guns-n-roses-and-the-making-of-appetite.pdfIn PDF document text
    • http://www.gorillawalker.com/el-emblema-del-traidor-spanish-edition-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/flourishing-for-healthcare-professionals-building-compassionate-resilience-for-your-well.pdfIn PDF document text
    • http://www.gorillawalker.com/dream-chaser-number-14-in-series-dark-hunter-world.pdfIn PDF document text
    • http://www.gorillawalker.com/my-bilingual-book-150-hearing-english-150-french-french-and.pdfIn PDF document text
    • http://www.gorillawalker.com/croatia-michelin-national-maps.pdfIn PDF document text
    • http://www.gorillawalker.com/reconstructing-development-theory-international-inequality-institutional-reform-and-social-emancipation.pdfIn PDF document text
    • http://www.gorillawalker.com/art-of-ceres.pdfIn PDF document text
    • http://www.gorillawalker.com/jesus-ist-der-weg-german-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/an-introduction-to-international-lacrosse-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/rapid-development-taming-wild-software-schedules.pdfIn PDF document text
    • http://www.gorillawalker.com/stress-and-cardiovascular-disease.pdfIn PDF document text
    • http://www.gorillawalker.com/police-oral-board-interview-over-100-police-interview-questions-answers.pdfIn PDF document text
    • http://www.gorillawalker.com/surviving-hard-times.pdfIn PDF document text
    • http://www.gorillawalker.com/sacred-signs.pdfIn PDF document text
    • http://www.gorillawalker.com/mind-games-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/the-mouse-who-saved-egypt.pdfIn PDF document text
    • http://www.gorillawalker.com/dramatic-masterpieces-for-the-cornetist-book-cd.pdfIn PDF document text
    • http://www.gorillawalker.com/ford-slack-taut-bundle-rook-ronin-spin-off-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/21-principios-tm-el-sistema-de-vanguardia-para-xito-y.pdfIn PDF document text
    • http://www.gorillawalker.com/prince-eugen-of-savoy-phoenix-press.pdfIn PDF document text
    • http://www.gorillawalker.com/i-miei-genitori-non-hanno-figli-einaudi-stile-libero-big.pdfIn PDF document text
    • http://www.gorillawalker.com/en-busca-del-sol-spanish-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/chiropractic-your-approach-to-better-living.pdfIn PDF document text
    • http://www.gorillawalker.com/the-science-and-technology-of-materials-in-automotive-engines.pdfIn PDF document text
    • http://www.gorillawalker.com/sexed-pistols-the-gendered-impacts-of-small-arms-and-light.pdfIn PDF document text
    • http://www.gorillawalker.com/dinosaur-world-pledger-sticker-book.pdfIn PDF document text
    • http://www.gorillawalker.com/furby-trainer-s-guide.pdfIn PDF document text
    • http://www.gorillawalker.com/spirit-guides-angel-guardians-contact-your-invisible-helpers.pdfIn PDF document text
    • http://www.gorillawalker.com/mustang-gallery.pdfIn PDF document text
    • http://www.gorillawalker.com/the-shadow-government.pdfIn PDF document text
    • http://www.gorillawalker.com/living-together-in-new-jersey.pdfIn PDF document text
    • http://www.gorillawalker.com/songs-of-kaumatua-traditional-songs-of-the-maori-as-sung.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.