Malicious PDF — malware analysis report

Static analysis result for SHA-256 a85606639b117733…

MALICIOUS

PDF

38.9 KB Created: 2019-04-03 20:37:08 +03:00 Authoring application: Adobe InDesign CS4 (6.0.6) (via Mac OS X 10.9.1 Quartz PDFContext)
MD5: a96ada295de54da7a2d9a8cc095943d9 SHA-1: 3e0cc48b1372ed945fc055cd912c38f70b1ffd6b SHA-256: a85606639b11773340804c49a86906ea462436d9adbe11beded6b8d0f79483cb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF documents on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute a payload. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9526

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-burden-of-democracy-the-claims-of-cultures-public-culture.pdf
    • http://www.gorillawalker.com/harnessing-people-power-committees-and-sporting-organizations-the-international-sport.pdf
    • http://www.gorillawalker.com/tiger-town.pdf
    • http://www.gorillawalker.com/die-meistersinger-von-n-rnberg-wwv-96-suite-for-orchestra.pdf
    • http://www.gorillawalker.com/what-if.pdf
    • http://www.gorillawalker.com/when-it-comes-to-the-crunch-the-mechanics-of-car.pdf
    • http://www.gorillawalker.com/wong-s-nursing-care-of-infants-and-children-8e.pdf
    • http://www.gorillawalker.com/american-english-file-4-5-usb.pdf
    • http://www.gorillawalker.com/bullying-is-no-laughing-matter.pdf
    • http://www.gorillawalker.com/barrayar.pdf
    • http://www.gorillawalker.com/south-africa-s-political-crisis-unfinished-liberation-and-fractured-class.pdf
    • http://www.gorillawalker.com/ghosts-dover-thrift-editions.pdf
    • http://www.gorillawalker.com/eating-drinking-overthinking-the-toxic-triangle-of-food-alcohol-and.pdf
    • http://www.gorillawalker.com/heinemann-history-study-units-student-book-the-french-revolution.pdf
    • http://www.gorillawalker.com/a-kiss-is-a-kiss-is-a-kiss.pdf
    • http://www.gorillawalker.com/by-kenneth-blanchard-sheldon-bowles-raving-fans-a-revolutionary-approach.pdf
    • http://www.gorillawalker.com/black-man-of-the-nile.pdf
    • http://www.gorillawalker.com/the-last-changeling-the-seelie-wars.pdf
    • http://www.gorillawalker.com/medical-informatics-a-selective-bibliography-monographs-gmrmln-update.pdf
    • http://www.gorillawalker.com/guatemala-eterna-primavera-eterna-tirania-eternal-spring-eternal-tyranny-spanish.pdf
    • http://www.gorillawalker.com/luca-will-nicht-in-die-schule-gehen-eine-geschichte-f.pdf
    • http://www.gorillawalker.com/urgent-fury-the-battle-for-grenada-the-truth-behind-the.pdf
    • http://www.gorillawalker.com/optimization-of-low-thrust-trajectories-with-terminal-aerocapture-kindle-edition.pdf
    • http://www.gorillawalker.com/academic-writing-concepts-and-connections.pdf
    • http://www.gorillawalker.com/inspections-and-reports-on-dwellings-series-inspections-and-reports-on.pdf
    • http://www.gorillawalker.com/women-romantic-poets-1770-1838-an-anthology.pdf
    • http://www.gorillawalker.com/pirate-royal-historical-fiction-for-teens-illustrated-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/managing-asthma-a-growth-and-development-approach-an-article-from.pdf
    • http://www.gorillawalker.com/circular-v-854a.pdf
    • http://www.gorillawalker.com/the-garden-at-hidcote.pdf
    • http://www.gorillawalker.com/gospel-trilogy.pdf
    • http://www.gorillawalker.com/tar-ntulas-goliat-aranas-spanish-edition.pdf
    • http://www.gorillawalker.com/the-month-that-changed-the-world-july-1914.pdf
    • http://www.gorillawalker.com/linear-operator-theory-in-engineering-and-science-applied-mathematical-sciences.pdf
    • http://www.gorillawalker.com/privilege-power-and-difference.pdf
    • http://www.gorillawalker.com/first-international-neck-and-back-pain-papers-meta-chinese-edition.pdf
    • http://www.gorillawalker.com/executing-the-supply-chain-modeling-best-in-class-processes-and.pdf
    • http://www.gorillawalker.com/written-judgements-vol-2.pdf
    • http://www.gorillawalker.com/perche-leggere-i-classici-italian-edition.pdf
    • http://www.gorillawalker.com/getting-to-know-thailand.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.