Malicious PDF — malware analysis report

Static analysis result for SHA-256 b53de2b5648cff1d…

MALICIOUS

PDF

45.0 KB Created: 2018-11-14 11:22:46 +03:00 Authoring application: Arbortext Publishing Engine (via PDFlib+PDI 8.0.2p1 (Win32))
MD5: 2f19c79058a4ddc759d380a88743f95c SHA-1: 49234b624c392571d794828005110268a6e1a1e8 SHA-256: b53de2b5648cff1dd5b80acc4f3e525ec82cf3fa03c77b872ce2218c7ac9ed4f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'www.gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8640

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-book-of-daniel-anchor-bible.pdf
    • http://www.gorillawalker.com/the-trans-siberian-express.pdf
    • http://www.gorillawalker.com/reduction-of-plasma-triglyceride-level-and-enhancement-of-plasma-albumin.pdf
    • http://www.gorillawalker.com/larry-teaches-opening-leads.pdf
    • http://www.gorillawalker.com/integrated-neuroscience-and-neurology-a-clinical-case-history-problem-solving.pdf
    • http://www.gorillawalker.com/relentless-the-memoir-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/keyboard-instruments-the-instruments-the-music-the-musicians.pdf
    • http://www.gorillawalker.com/breaking-demonic-strongholds-defeating-the-lies-of-satan.pdf
    • http://www.gorillawalker.com/crystal-healing-a-beginners-guide-to-self-healing-crystal-healing.pdf
    • http://www.gorillawalker.com/the-tao-of-leadership-kindle-edition.pdf
    • http://www.gorillawalker.com/the-homosexual-agenda-exposing-the-principal-threat-to-religious-freedom.pdf
    • http://www.gorillawalker.com/high-resolution-separation-and-analysis-of-biological-macromolecules-part-a.pdf
    • http://www.gorillawalker.com/solidarit-french-edition.pdf
    • http://www.gorillawalker.com/the-urban-school-system-of-the-future-applying-the-principles.pdf
    • http://www.gorillawalker.com/sixty-selected-studies-french-horn-method-or-collection-0-kalmus.pdf
    • http://www.gorillawalker.com/torn-apart-the-life-of-ian-curtis.pdf
    • http://www.gorillawalker.com/fish-histology-female-reproductive-systems.pdf
    • http://www.gorillawalker.com/uncle-john-s-bathroom-reader-tees-off-on-golf.pdf
    • http://www.gorillawalker.com/psychic-dreamwalking-explorations-at-the-edge-of-self.pdf
    • http://www.gorillawalker.com/the-puffer-cookbook.pdf
    • http://www.gorillawalker.com/california-penal-code-unabridged-2010.pdf
    • http://www.gorillawalker.com/the-custer-adventure.pdf
    • http://www.gorillawalker.com/by-bob-baker-guerrilla-music-marketing-handbook-201-self-promotion.pdf
    • http://www.gorillawalker.com/canoe-and-white-water-from-essential-to-sport.pdf
    • http://www.gorillawalker.com/aip-physics-desk-reference-physicist-s-desk-reference.pdf
    • http://www.gorillawalker.com/the-heretic-s-treasure-ben-hope-unabridged-digital.pdf
    • http://www.gorillawalker.com/silence-your-mind-improve-your-happiness-in-just-10-minutes.pdf
    • http://www.gorillawalker.com/essential-denmark-aa-essential.pdf
    • http://www.gorillawalker.com/an-introduction-to-numerical-weather-prediction-techniques.pdf
    • http://www.gorillawalker.com/sphr-exam-flashcard-study-system-sphr-test-practice-questions-review.pdf
    • http://www.gorillawalker.com/we-will-remember-them.pdf
    • http://www.gorillawalker.com/hopi-new-version-bassoon.pdf
    • http://www.gorillawalker.com/suckers-andrew-mayhem-harry-mcglade-thrillers.pdf
    • http://www.gorillawalker.com/hazardous-substances-resource-guide-gale-environmental-library.pdf
    • http://www.gorillawalker.com/hmh-steck-vaughn-ca-gateways-california-student-practice-book-level.pdf
    • http://www.gorillawalker.com/spirituality-recharted.pdf
    • http://www.gorillawalker.com/reiki-false-beliefs-exposed-for-all-misinformation-kept-secret-by.pdf
    • http://www.gorillawalker.com/let-s-learn-chinese-elementary-level-simplified-chinese-version.pdf
    • http://www.gorillawalker.com/materials-structures-and-standards-all-the-details-architects-need-to.pdf
    • http://www.gorillawalker.com/mail-order-bride-savannah-s-cowboy-westward-wanted-book-2.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.