Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa631da7be9ed0e3…

MALICIOUS

PDF

45.4 KB Created: 2018-11-26 20:06:42 +03:00 Authoring application: Adobe InDesign CS3 (5.0) (via Adobe PDF Library 8.0)
MD5: 3a6b52e677f7e0b4667957b42b4562cf SHA-1: 08e5db1248458d99d93f76b12d58ffc0b6f7f021 SHA-256: aa631da7be9ed0e39c4acf0c9e4fa315026faf7d60ff607490b13cdc2e6989f1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF sample was flagged by a critical heuristic for containing a large number of external links, specifically pointing to PDF files on 'gorillawalker.com'. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the sheer volume of outbound links suggests a malicious intent, possibly for SEO abuse or to distribute additional malware. The document body was heavily obfuscated and unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8389

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/early-book-illustration-in-spain.pdf
    • http://www.gorillawalker.com/the-little-black-book-of-washington-d-c-the-essential.pdf
    • http://www.gorillawalker.com/relationship-safety-skills-handbook-stop-domestic-dating-and-interpersonal-violence.pdf
    • http://www.gorillawalker.com/property-and-community.pdf
    • http://www.gorillawalker.com/rudin.pdf
    • http://www.gorillawalker.com/parents-have-the-power-to-make-special-education-work-an.pdf
    • http://www.gorillawalker.com/a-modern-twist-create-quilts-with-a-colorful-spin.pdf
    • http://www.gorillawalker.com/marine-environment-protection-and-biodiversity-conservation-the-application-and-future.pdf
    • http://www.gorillawalker.com/walks-through-rome.pdf
    • http://www.gorillawalker.com/101-fantastic-low-carb-recipes.pdf
    • http://www.gorillawalker.com/shanghai-policeman.pdf
    • http://www.gorillawalker.com/saving-farmland-the-fight-for-real-food.pdf
    • http://www.gorillawalker.com/the-human-figure-2.pdf
    • http://www.gorillawalker.com/web-designer-guide-to-photoshop.pdf
    • http://www.gorillawalker.com/the-texas-cowboy-kitchen.pdf
    • http://www.gorillawalker.com/kids-poems-grades-1.pdf
    • http://www.gorillawalker.com/legends-cincinnati-bengals-the-men-the-deeds-the-consequences.pdf
    • http://www.gorillawalker.com/irritable-bowel-syndrome-special-diet-cookbook.pdf
    • http://www.gorillawalker.com/graphical-approach-to-college-algebra-and-trigonometry-2nd-edition.pdf
    • http://www.gorillawalker.com/mccall-s-cooking-school-recipe-card-desserts-31-mincemeat-glace.pdf
    • http://www.gorillawalker.com/quest-ce-que-le-structuralisme-no-5-philosophie-french-edition.pdf
    • http://www.gorillawalker.com/differentiated-reading-instruction-in-grades-4-and-5-strategies-and.pdf
    • http://www.gorillawalker.com/rich-the-reality-of-encountering-jesus.pdf
    • http://www.gorillawalker.com/fall-away-seals-undone-volume-3.pdf
    • http://www.gorillawalker.com/masteringbiology-with-pearson-etext-standalone-access-card-for-campbell-biology.pdf
    • http://www.gorillawalker.com/poland-city-map-gliwice-4-other-cities-chorzow-ruda-slaska.pdf
    • http://www.gorillawalker.com/the-libertarian-mind-a-manifesto-for-freedom-kindle-edition.pdf
    • http://www.gorillawalker.com/the-atomic-nucleus-copyright-1955.pdf
    • http://www.gorillawalker.com/humanism-in-economics-and-business-perspectives-of-the-catholic-social.pdf
    • http://www.gorillawalker.com/the-social-media-reader.pdf
    • http://www.gorillawalker.com/books-and-society-in-history-preconference-papers.pdf
    • http://www.gorillawalker.com/hold-it-against-me-difficulty-and-emotion-in-contemporary-art.pdf
    • http://www.gorillawalker.com/location-based-services-and-geo-information-engineering.pdf
    • http://www.gorillawalker.com/archiv-for-pharmaci-og-technisk-chemi-med-deres-grundvidenskaber-volume.pdf
    • http://www.gorillawalker.com/galileo-bellarmine-and-the-bible.pdf
    • http://www.gorillawalker.com/fatigue-design-of-steel-and-composite-structures-eurocode-3-design.pdf
    • http://www.gorillawalker.com/individual-strategy-and-social-structure-an-evolutionary-theory-of-institutions.pdf
    • http://www.gorillawalker.com/lacrosse-essentials.pdf
    • http://www.gorillawalker.com/jasmine-flower-chinese-folk-song-english-words-by-charlotte-lee.pdf
    • http://www.gorillawalker.com/running-the-edge-discovering-the-secrets-to-better-running-and.pdf
    • http://www.gorillawalker.com/relationship-safety-skills-handbook-st
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.