Malicious PDF — malware analysis report

Static analysis result for SHA-256 b17fcdb18876eabc…

MALICIOUS

PDF

41.8 KB Created: 2018-12-03 17:05:41 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 8.0.0 (Windows))
MD5: 780723b6bcce3c24a4925be5a10cb221 SHA-1: cdd5d1a2dca06d4c38d39d86119ecbe1d5226939 SHA-256: b17fcdb18876eabc4a172399cc90d1864d29cbc080ff8099525460a46cbc77f1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents hosted on www.gorillawalker.com. The document body itself is heavily obfuscated and contains repeated URLs, suggesting a tactic to manipulate search engine results or to distribute a large number of potentially malicious documents. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/student-s-solutions-manual-for-precalculus-functions-and-graphs.pdf
    • http://www.gorillawalker.com/the-book-of-tobit-a-chaldee-text-from-a-unique.pdf
    • http://www.gorillawalker.com/remarkably-great-strangely-incredibly-good-book-2.pdf
    • http://www.gorillawalker.com/erase-una-vez-manhattan-manhattan-when-i-was-young-spanish.pdf
    • http://www.gorillawalker.com/pirelli-calendar-classics-over-100-remarkable-images-from-the-legendary.pdf
    • http://www.gorillawalker.com/a-short-history-of-medieval-philosophy.pdf
    • http://www.gorillawalker.com/so-obstinately-loyal-james-moody-1744-153-1809.pdf
    • http://www.gorillawalker.com/the-smoker-s-guide-to-vitamins-and-health.pdf
    • http://www.gorillawalker.com/the-salsa-guidebook-kindle-edition.pdf
    • http://www.gorillawalker.com/library-of-congress-subject-headings-philosophy-practice-and-prospects-haworth.pdf
    • http://www.gorillawalker.com/165-dynamic-sermon-outlines-sermon-outline-series.pdf
    • http://www.gorillawalker.com/aviation-maintenance-technician-airframe-volume-2-ebundle-volume-2-systems.pdf
    • http://www.gorillawalker.com/die-verderbnis-der-magie-unsterblichen-epos-4-german-edition-kindle.pdf
    • http://www.gorillawalker.com/michelin-green-guide-northern-france-paris-region-green-guide-michelin.pdf
    • http://www.gorillawalker.com/assembled-2012-select-sermons-and-lectures-from-the-general-assembly.pdf
    • http://www.gorillawalker.com/the-white-palace-awakens-a-strange-place-in-time-book.pdf
    • http://www.gorillawalker.com/the-tao-of-architecture.pdf
    • http://www.gorillawalker.com/rommel-s-war-in-africa.pdf
    • http://www.gorillawalker.com/fundamentals-of-financial-management.pdf
    • http://www.gorillawalker.com/daisy-the-calico-kitty.pdf
    • http://www.gorillawalker.com/die-kreuzelschreiber-bauernkom-die-mit-gesang-in-drei-akten-german.pdf
    • http://www.gorillawalker.com/german-shepherds-calendar-multilingual-edition.pdf
    • http://www.gorillawalker.com/quick-start-keyboard-kit-includes-cassette.pdf
    • http://www.gorillawalker.com/socrates-and-aristophanes.pdf
    • http://www.gorillawalker.com/taking-charge-the-electric-automobile-in-america.pdf
    • http://www.gorillawalker.com/redesigning-schools-for-success-implementing-small-learning-communities-and-teacher.pdf
    • http://www.gorillawalker.com/advanced-android-application-development-4th-edition-developer-s-library-kindle.pdf
    • http://www.gorillawalker.com/paul-saint-of-the-inner-city.pdf
    • http://www.gorillawalker.com/could-it-be-an-allergy-a-comprehensive-guide-to-allergic.pdf
    • http://www.gorillawalker.com/wealth-and-the-wealthy-exploring-and-tackling-inequalities-between-rich.pdf
    • http://www.gorillawalker.com/problem-solving-with-math-models-fourth-grade-bw.pdf
    • http://www.gorillawalker.com/in-the-company-of-animals-a-study-of-human-animal.pdf
    • http://www.gorillawalker.com/ink-on-his-fingers.pdf
    • http://www.gorillawalker.com/conservatism-and-postcolonial-politics.pdf
    • http://www.gorillawalker.com/the-hymns-on-faith-fathers-of-the-church.pdf
    • http://www.gorillawalker.com/standing-tall-the-stories-of-ten-hispanic-americans-scholastic-biography.pdf
    • http://www.gorillawalker.com/a-test-bench-for-study-of-liquid-rocket-engines-design.pdf
    • http://www.gorillawalker.com/black-hills-forever-black-hills-series-book-5.pdf
    • http://www.gorillawalker.com/surfing-indonesia-periplus-action-guides.pdf
    • http://www.gorillawalker.com/fish-perfectly-simple.pdf
    • http://www.gorillawalker.com/so-obstinately-loyal-james-moody
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.