Malicious PDF — malware analysis report

Static analysis result for SHA-256 aaedc195aa4ab7f8…

MALICIOUS

PDF

42.1 KB Created: 2019-03-19 16:19:56 +03:00 Authoring application: Adobe InDesign CC 2017 (Windows) (via Adobe PDF Library 15.0)
MD5: cfa4d2727bc5fd7e845bece19f9ae72b SHA-1: 5f9b357ea8db352a325db28f217a90c86f37af47 SHA-256: aaedc195aa4ab7f8481cf2cc8ee5af5636c093f43823e814b203e382ce6e467b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to external PDF documents on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or as a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/grace-and-power-the-private-world-of-the-kennedy-white.pdf
    • http://www.gorillawalker.com/creative-cooking-for-simple-elegance-tips-to-create-simple-elegant.pdf
    • http://www.gorillawalker.com/flowers-first-step-nonfiction.pdf
    • http://www.gorillawalker.com/freedom-a-dialogue.pdf
    • http://www.gorillawalker.com/the-elements-of-style-third-edition-with-index.pdf
    • http://www.gorillawalker.com/biblia-plenitud-biblia-plenitud.pdf
    • http://www.gorillawalker.com/eden-it-s-an-endless-world-vol-10-v-10.pdf
    • http://www.gorillawalker.com/historia-de-la-orquesta-ti-129-pica-evolucio-129-n.pdf
    • http://www.gorillawalker.com/destroyer-086-arabian-nightmare.pdf
    • http://www.gorillawalker.com/project-management-for-mere-mortals.pdf
    • http://www.gorillawalker.com/america-s-massacre-the-audacity-of-despair-and-a-message.pdf
    • http://www.gorillawalker.com/predicting-outdoor-sound.pdf
    • http://www.gorillawalker.com/mountain-high-europe-s-50-greatest-cycle-climbs.pdf
    • http://www.gorillawalker.com/customary-law-of-punjab-and-haryana.pdf
    • http://www.gorillawalker.com/implementation-of-oil-related-environmental-policies-in-nigeria-government-inertia.pdf
    • http://www.gorillawalker.com/uncensored-women-4-uncensored-women-adult-erotic-picture-book.pdf
    • http://www.gorillawalker.com/the-heston-model-and-its-extensions-in-vba-wiley-finance.pdf
    • http://www.gorillawalker.com/the-bedford-anthology-of-american-literature-volume-two-1865-to.pdf
    • http://www.gorillawalker.com/the-london-stage-1940-1949.pdf
    • http://www.gorillawalker.com/the-king-arthur-flour-baker-s-companion-the-all-purpose.pdf
    • http://www.gorillawalker.com/earth-before-the-dinosaurs-life-of-the-past.pdf
    • http://www.gorillawalker.com/seven-foot-knoll.pdf
    • http://www.gorillawalker.com/antigua-guatemala-a-city-guide.pdf
    • http://www.gorillawalker.com/john-patrick-s-craps-so-you-wanna-be-a-gambler.pdf
    • http://www.gorillawalker.com/carbohydrates-what-you-need-to-know.pdf
    • http://www.gorillawalker.com/she-devil-rocks.pdf
    • http://www.gorillawalker.com/dog-butterfly.pdf
    • http://www.gorillawalker.com/women-s-gymnastics-trivia.pdf
    • http://www.gorillawalker.com/theory-and-practice-of-arc-welding.pdf
    • http://www.gorillawalker.com/foodservice-procurement-purchasing-for-profit.pdf
    • http://www.gorillawalker.com/mammie-s-mail-order-bride-sheriff-bride-volume-6.pdf
    • http://www.gorillawalker.com/edward-seago.pdf
    • http://www.gorillawalker.com/algebra-2-w-trigononmetry-5e-smith-standardized-test-preparation-workbook.pdf
    • http://www.gorillawalker.com/guiding-those-left-behind-in-texas.pdf
    • http://www.gorillawalker.com/the-chocolate-travel-guide-united-states-edition-2010.pdf
    • http://www.gorillawalker.com/cachao-master-sessions-vol-1-bass-guitar-tab.pdf
    • http://www.gorillawalker.com/the-millennium-falcon-owner-s-workshop-manual-star-wars-haynes.pdf
    • http://www.gorillawalker.com/rusty-wilson-s-favorite-bigfoot-campfire-stories.pdf
    • http://www.gorillawalker.com/a-handbook-for-travellers-in-india-pakistan-burma-and-ceylon.pdf
    • http://www.gorillawalker.com/cuentos-sediciosos-y-bolivarianos-spanish-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.