Malicious PDF — malware analysis report

Static analysis result for SHA-256 adf9171d5e9b850d…

MALICIOUS

PDF

43.4 KB Created: 2018-11-26 20:07:17 +03:00 Authoring application: Adobe Acrobat 6.0 (via Adobe Acrobat 6.0 Paper Capture Plug-in)
MD5: 3d6ca30d197f3e763f5bd5717d5b601a SHA-1: d712b1ad7628bc1ecb665e5bbe8115a21c58a342 SHA-256: adf9171d5e9b850d5b0f363331b71ff220c6fc0c8beaa60190acb2da09efe216
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, consistent with a link farm or SEO poisoning attack. The document body contains numerous URLs pointing to PDF files on the domain 'gorillawalker.com', suggesting a coordinated effort to distribute content or redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/synthetic-organic-electrochemistry-2nd-edition.pdf
    • http://www.gorillawalker.com/calendar-2015-daily-planner-and-organizer-us-calendar-kindle-edition.pdf
    • http://www.gorillawalker.com/the-works-of-francis-bacon-cambridge-library-collection-philosophy-volume.pdf
    • http://www.gorillawalker.com/passing-the-test-combat-in-korea-april-june-1951-battles.pdf
    • http://www.gorillawalker.com/eieio-how-old-macdonald-got-his-farm-with-a-little.pdf
    • http://www.gorillawalker.com/official-price-guide-to-military-collectibles-sixth-edition.pdf
    • http://www.gorillawalker.com/the-new-york-four-a-minx-title-minx.pdf
    • http://www.gorillawalker.com/the-last-generation-of-the-roman-republic.pdf
    • http://www.gorillawalker.com/the-official-football-yearbook-of-the-english-and-scottish-leagues.pdf
    • http://www.gorillawalker.com/lie-groups-a-problem-oriented-introduction-via-matrix-groups-mathematical.pdf
    • http://www.gorillawalker.com/spacex-making-commercial-spaceflight-a-reality-springer-praxis-books.pdf
    • http://www.gorillawalker.com/computerized-testing-supplement-for-aviation-mechanic-general-powerplant-and-airframe.pdf
    • http://www.gorillawalker.com/crossing-instant-yong-sports-documentary-photography-12-color-coated-paper.pdf
    • http://www.gorillawalker.com/get-your-loved-one-sober-alternatives-to-nagging-pleading-and.pdf
    • http://www.gorillawalker.com/the-blood-vivicanti-part-1.pdf
    • http://www.gorillawalker.com/king-of-the-bowery-big-tim-sullivan-tammany-hall-and.pdf
    • http://www.gorillawalker.com/2-m-lodies-op-27-clarinet-1-and-2-parts.pdf
    • http://www.gorillawalker.com/the-dream-on-blanca-s-wall-el-sueno-pegado-en.pdf
    • http://www.gorillawalker.com/cologne-baedeker-guide-baedeker-guides.pdf
    • http://www.gorillawalker.com/dementia-delmar-s-nursing-assisting-video-series-tape-17.pdf
    • http://www.gorillawalker.com/yearning-to-breathe-free-liberation-theologies-in-the-united-states.pdf
    • http://www.gorillawalker.com/north-american-cornucopia-top-100-indigenous-food-plants.pdf
    • http://www.gorillawalker.com/the-unofficial-guide-to-walt-disney-world-2001-unofficial-guides.pdf
    • http://www.gorillawalker.com/spanish-for-the-busy-teacher-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/in-bed-with-a-rogue-rival-rogues-book-2.pdf
    • http://www.gorillawalker.com/900-point-you-practice-toeic-dojo-also-take-surely-the.pdf
    • http://www.gorillawalker.com/ancient-paths.pdf
    • http://www.gorillawalker.com/educating-for-deliberative-democracy-new-directions-for-higher-education-nunber.pdf
    • http://www.gorillawalker.com/spellbound-wicked-series.pdf
    • http://www.gorillawalker.com/journal-of-a-voyage-to-brazil.pdf
    • http://www.gorillawalker.com/salamanca-guiarama-spanish-edition.pdf
    • http://www.gorillawalker.com/boxing-rabbits-bellowing-alligators-courtship-poems-from-the-animal-world.pdf
    • http://www.gorillawalker.com/wannabe-choose-your-own-celebrity-adventure.pdf
    • http://www.gorillawalker.com/how-to-write-and-sell-mystery-fiction.pdf
    • http://www.gorillawalker.com/the-fall-of-the-faculty-the-rise-of-the-all.pdf
    • http://www.gorillawalker.com/they-all-fall-down.pdf
    • http://www.gorillawalker.com/transforming-debt-into-wealth-volume-1-debt-elimination.pdf
    • http://www.gorillawalker.com/past-lives-future-lives-revealed.pdf
    • http://www.gorillawalker.com/the-really-jewish-food-guide-2009.pdf
    • http://www.gorillawalker.com/samurai-armor-design.pdf
    • http://www.gorillawalker.com/lie-groups-a-problem-oriented-introduction-vi
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.