Malicious PDF — malware analysis report

Static analysis result for SHA-256 abcb1f2939d7fa2e…

MALICIOUS

PDF

43.6 KB Created: 2018-11-15 18:31:41 +03:00 Authoring application: - (via ABBYY FineReader 9.0 Sprint)
MD5: 43382bff88bfbb90bd2b9dffe9b9dd5a SHA-1: 7989c8874ee42ad03a6915e6aa1c45a433c11d71 SHA-256: abcb1f2939d7fa2e24577b5026d860d89513a14ba00bf6ebfe9d543b8ed46f73
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by a machine learning classifier and contains a large number of embedded links to external PDF files hosted on gorillawalker.com. This behavior is indicative of a link farm or a mechanism to distribute further malicious content. The document body itself is heavily obfuscated and does not provide clear textual clues about its intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8224

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/taoist-ways-to-transform-stress-into-vitality-the-inner-smile.pdf
    • http://www.gorillawalker.com/bigtime-ragtime-marches-level-4.pdf
    • http://www.gorillawalker.com/a-caledonian-feast.pdf
    • http://www.gorillawalker.com/resiliency-an-integrated-approach-to-practice-policy-and-research.pdf
    • http://www.gorillawalker.com/putin-redux-power-and-contradiction-in-contemporary-russia.pdf
    • http://www.gorillawalker.com/procesamiento-t-rmico-de-frutas-y-hortalizas-thermal-processing-of.pdf
    • http://www.gorillawalker.com/encyclopedia-of-prehistory-volume-2-arctic-and-subarctic-elgar-reference.pdf
    • http://www.gorillawalker.com/the-new-sotheby-s-wine-encyclopedia-first-edition.pdf
    • http://www.gorillawalker.com/you-can-t-hide.pdf
    • http://www.gorillawalker.com/halliday-wine-companion-2015-james-halliday-australian-wine-companion-kindle.pdf
    • http://www.gorillawalker.com/alpha-beta-how-26-letters-shaped-the-western-world.pdf
    • http://www.gorillawalker.com/dictionary-of-sports-and-games-terminology.pdf
    • http://www.gorillawalker.com/brave-girl-eating-a-family-s-struggle-with-anorexia.pdf
    • http://www.gorillawalker.com/how-mr-monkey-saw-the-whole-world.pdf
    • http://www.gorillawalker.com/007-exotic-location-key-west.pdf
    • http://www.gorillawalker.com/lange-q-a-surgical-technology-examination-sixth-edition-lange-q.pdf
    • http://www.gorillawalker.com/safety-signs-cheap-chart.pdf
    • http://www.gorillawalker.com/wandering-in-darkness-narrative-and-the-problem-of-suffering.pdf
    • http://www.gorillawalker.com/the-end-and-the-beginning-pope-john-paul-ii-the.pdf
    • http://www.gorillawalker.com/parents-and-professionals-partnering-for-children-with-disabilities-a-dance.pdf
    • http://www.gorillawalker.com/god-by-topic-wisdom-god-s-word-by-topic-at.pdf
    • http://www.gorillawalker.com/the-stock-market-credit-and-capital-formation.pdf
    • http://www.gorillawalker.com/air-travel-and-health-a-systems-perspective-aerospace-series.pdf
    • http://www.gorillawalker.com/trans-generational-trauma-passing-it-on.pdf
    • http://www.gorillawalker.com/penny-breyer-stablemates.pdf
    • http://www.gorillawalker.com/teoria-y-metodologia-del-derecho-theory-and-methodology-of-law.pdf
    • http://www.gorillawalker.com/thus-spoke-zarathustra-a-book-for-everyone-and-nobody-oxford.pdf
    • http://www.gorillawalker.com/excel-vba-a-beginners-guide.pdf
    • http://www.gorillawalker.com/calcular-el-area-cohete-espacial-monstruos-matematicos-spanish-edition.pdf
    • http://www.gorillawalker.com/erotica-triple-pack-volume-18.pdf
    • http://www.gorillawalker.com/the-story-of-hampton-court-palace.pdf
    • http://www.gorillawalker.com/the-secret-diary-of-sarah-thomas-a-victorian-lady-1860.pdf
    • http://www.gorillawalker.com/a-little-jazz-mass-satb-vocal-score.pdf
    • http://www.gorillawalker.com/brave-bilder-german-edition.pdf
    • http://www.gorillawalker.com/russian-strategic-nuclear-forces.pdf
    • http://www.gorillawalker.com/scratch-and-sparkle-spiro-art.pdf
    • http://www.gorillawalker.com/chess-tactics-for-champions-a-step-by-step-guide-to.pdf
    • http://www.gorillawalker.com/james-bond-goldfinger.pdf
    • http://www.gorillawalker.com/concepts-of-jewish-music-and-prayer.pdf
    • http://www.gorillawalker.com/web-applications-hacking-exposed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.