Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae5d728db1cb3f6e…

MALICIOUS

PDF

44.9 KB Created: 2018-11-23 08:09:03 +03:00 Authoring application: LaTeX with hyperref package (via dvips + ps2pdf)
MD5: e5e8ca5c31f2395678968e6836587537 SHA-1: e01cc5257a54c61d5f97ee1ccea6ee32e767dfe9 SHA-256: ae5d728db1cb3f6e2c428b102e1265762290bb83e49c8ab4ad30bf20b4c4caae
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of external links, indicating a link farm or SEO poisoning attack. The embedded URLs point to various PDF documents hosted on gorillawalker.com, suggesting a content distribution or redirection scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9005

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/used-volkswagen-lupo-buyer-s-guide-1999-present.pdf
    • http://www.gorillawalker.com/red-bones-a-thriller-shetland-island-mysteries.pdf
    • http://www.gorillawalker.com/a-splendid-exchange-how-trade-shaped-the-world-unabridged-audible.pdf
    • http://www.gorillawalker.com/collision-course-star-trek-academy.pdf
    • http://www.gorillawalker.com/the-future-of-african-customary-law.pdf
    • http://www.gorillawalker.com/complete-weight-loss.pdf
    • http://www.gorillawalker.com/the-concrete-house-building-solid-safe-efficient-with-insulating-concrete.pdf
    • http://www.gorillawalker.com/francis-allen-ellis-historic-photography-the-city-of-detroit.pdf
    • http://www.gorillawalker.com/in-defense-of-doctrine-evangelicalism-theology-and-scripture-emerging-scholars.pdf
    • http://www.gorillawalker.com/practicing-the-presence-of-god-learn-to-live-moment-by.pdf
    • http://www.gorillawalker.com/games-prisoners-play-the-tragicomic-worlds-of-polish-prison.pdf
    • http://www.gorillawalker.com/fast-and-fancy-revolver-shooting-and-police-training.pdf
    • http://www.gorillawalker.com/the-artifact-the-bodyguard-book-1-m-m-supernatural-mystery.pdf
    • http://www.gorillawalker.com/hadji-bektach-un-mythe-et-ses-avatars-genese-et-evolution.pdf
    • http://www.gorillawalker.com/advanced-microsystems-for-automotive-applications-2013-smart-systems-for-safe.pdf
    • http://www.gorillawalker.com/handbook-of-early-childhood-intervention.pdf
    • http://www.gorillawalker.com/like-the-tendrils-of-a-vine-brothers-in-arms-part.pdf
    • http://www.gorillawalker.com/falstaff-vocal-score.pdf
    • http://www.gorillawalker.com/fela-anikulapo-kuti-the-primary-man-of-an-african-personality.pdf
    • http://www.gorillawalker.com/mine-haha-vollst-ndige-ausgabe-kontroverses-werk-ber-die-k.pdf
    • http://www.gorillawalker.com/the-adventures-of-super3-a-teacher-s-guide-to-information.pdf
    • http://www.gorillawalker.com/el-duque-de-tres-monta-as-spanish-edition.pdf
    • http://www.gorillawalker.com/diccionario-de-terminos-juridicos-ingles-espanol-spanish-english-ariel-derecho.pdf
    • http://www.gorillawalker.com/chronic-diarrhea-an-issue-of-gastroenterology-clinics-1e-the-clinics.pdf
    • http://www.gorillawalker.com/best-of-cairo-and-luxor-globetrotter-best-of-series.pdf
    • http://www.gorillawalker.com/dante-monarchy-cambridge-texts-in-the-history-of-political-thought.pdf
    • http://www.gorillawalker.com/the-story-blanket.pdf
    • http://www.gorillawalker.com/travelpreneur-see-the-world-make-money-and-do-what-you.pdf
    • http://www.gorillawalker.com/c-digo-de-comercio-de-los-estados-unidos-mexicanos-concordado.pdf
    • http://www.gorillawalker.com/the-fingerless-lady-living-in-my-head-one-guy-s.pdf
    • http://www.gorillawalker.com/los-jardines-interiores-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/a-brilliant-novel-in-the-works.pdf
    • http://www.gorillawalker.com/the-politics-of-national-languages-in-postcolonial-senegal.pdf
    • http://www.gorillawalker.com/the-goddess-oracle-deck-book-set.pdf
    • http://www.gorillawalker.com/innovacion-en-desarrollo-inmobiliario-un-nuevo-proceso-de-conceptualizacion-de.pdf
    • http://www.gorillawalker.com/henry-kissinger-world-leaders-past-and-present.pdf
    • http://www.gorillawalker.com/lonely-planet-ho-chi-minh-city-saigon.pdf
    • http://www.gorillawalker.com/i-changed-my-mind.pdf
    • http://www.gorillawalker.com/reinhold-messner-free-spirit-a-climber-s-life.pdf
    • http://www.gorillawalker.com/the-sea-of-stones-a-novel-in-three-parts-chicago.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.