Malicious PDF — malware analysis report

Static analysis result for SHA-256 af83cb050685a0d0…

MALICIOUS

PDF

40.3 KB Created: 2019-04-08 21:36:35 +03:00 Authoring application: pdftk 1.44 - www.pdftk.com (via itext-paulo-155 (itextpdf.sf.net-lowagie.com))
MD5: ab69ae3428e4bf6de20e0adb85b0f4ee SHA-1: 6decc63c5135802efe311b133a7d8bcdc4cd6b1b SHA-256: af83cb050685a0d0583f7b5e7a49fc35ec2e0bcafc2f20bceb42b5d6262115b6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute malicious content disguised as legitimate documents. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/open-networks-closed-regimes-the-impact-of-the-internet-on.pdf
    • http://www.gorillawalker.com/the-day-i-died.pdf
    • http://www.gorillawalker.com/mundo-maya-map-poster-belize-el-salvador-guatemala-honduras-mexico.pdf
    • http://www.gorillawalker.com/next.pdf
    • http://www.gorillawalker.com/ios-game-programming-with-xcode-and-cocos2d.pdf
    • http://www.gorillawalker.com/the-plane-watch-it-work.pdf
    • http://www.gorillawalker.com/the-wars-of-scotland-1214-1371-new-edinburgh-history-of.pdf
    • http://www.gorillawalker.com/lighthouses-of-canada-2014-mini-calendar.pdf
    • http://www.gorillawalker.com/20-years-of-style-the-world-according-to-paper.pdf
    • http://www.gorillawalker.com/popol-vuh-antiguas-leyendas-del-maya-quiche.pdf
    • http://www.gorillawalker.com/quantum-chemistry-prentice-hall-chemistry-series.pdf
    • http://www.gorillawalker.com/lord-and-peasant-in-russia-from-the-ninth-to-the.pdf
    • http://www.gorillawalker.com/america-burning-revisited-national-workshop-tyson-s-corner-virginia.pdf
    • http://www.gorillawalker.com/osteotomies-for-posttraumatic-deformities.pdf
    • http://www.gorillawalker.com/the-spell-book-of-wiccan-shadows.pdf
    • http://www.gorillawalker.com/a-family-flight-over-egypt-and-syria.pdf
    • http://www.gorillawalker.com/the-firebrand.pdf
    • http://www.gorillawalker.com/jubilee-reflections-rich-and-poor-in-christian-perspective.pdf
    • http://www.gorillawalker.com/moving-thoughts-life-of-an-observer-and-doer.pdf
    • http://www.gorillawalker.com/ninety-nine-names-of-allah.pdf
    • http://www.gorillawalker.com/caesar-s-gallic-wars.pdf
    • http://www.gorillawalker.com/the-educated-imagination-cbc-massey-lectures.pdf
    • http://www.gorillawalker.com/fifty-shades-of-beige-a-different-kind-of-love.pdf
    • http://www.gorillawalker.com/hunter-s-diseases-of-occupations-tenth-edition.pdf
    • http://www.gorillawalker.com/the-iraqi-nights-new-directions-paperbook.pdf
    • http://www.gorillawalker.com/hacker-mom.pdf
    • http://www.gorillawalker.com/toto-5-of-the-best-piano-vocal-guitar-artist-songbook.pdf
    • http://www.gorillawalker.com/tillandsia-the-world-s-most-unusual-airplants.pdf
    • http://www.gorillawalker.com/start-up-guide-for-the-technopreneur-website-financial-planning-decision.pdf
    • http://www.gorillawalker.com/colorist-a-practical-handbook-for-personal-and-professional-use.pdf
    • http://www.gorillawalker.com/the-ultimate-maze-book.pdf
    • http://www.gorillawalker.com/mein-bett-ist-nicht-zum-schlafen-da-german-edition.pdf
    • http://www.gorillawalker.com/a-load-of-hooey-a-collection-of-new-short-humor.pdf
    • http://www.gorillawalker.com/hotel-angeline-a-novel-in-36-voices-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/the-gospel-of-matthew-the-king-is-coming-21st-century.pdf
    • http://www.gorillawalker.com/never-built-los-angeles.pdf
    • http://www.gorillawalker.com/photographing-birds-art-and-techniques.pdf
    • http://www.gorillawalker.com/henry-klumb-principios-para-una-arquitectura-de-integracion-spanish-edition.pdf
    • http://www.gorillawalker.com/alfred-s-rudimental-contest-solos.pdf
    • http://www.gorillawalker.com/bound-by-the-enemy-his-willing-slave-reluctant-gay-bdsm.pdf
    • http://www.gorillawalker.com/quant
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.