Malicious PDF — malware analysis report

Static analysis result for SHA-256 b73e24c7656827a7…

MALICIOUS

PDF

42.0 KB Created: 2019-03-17 08:16:50 +03:00 Authoring application: PDFpen
MD5: 8668f1ba49b4b94842c75b3ed4c622d7 SHA-1: a61b3698ac7dd22f25a5f710fe9db47813732235 SHA-256: b73e24c7656827a7afe43d29b869a931542e10fffb3a5d9fd88ea25e78f3afac
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content indirectly. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, with the primary domain being www.gorillawalker.com. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-rise-fall-of-jim-crow-social-studies-history-of.pdf
    • http://www.gorillawalker.com/extreme-elvin.pdf
    • http://www.gorillawalker.com/microsoft-win32-developer-s-reference-library-shell-microsoft-developers-library.pdf
    • http://www.gorillawalker.com/rice-cooker-zojirushi-guide-the-best-recipes-for-your-rice.pdf
    • http://www.gorillawalker.com/safer-sex-for-young-people-16-18-posters.pdf
    • http://www.gorillawalker.com/applications-of-the-theory-of-matrices-dover-books-on-mathematics.pdf
    • http://www.gorillawalker.com/armida-by-joseph-haydn-vocal-score.pdf
    • http://www.gorillawalker.com/integrating-risk-management-and-asset-allocation.pdf
    • http://www.gorillawalker.com/manual-de-conocimientos-marineros-spanish-edition.pdf
    • http://www.gorillawalker.com/a-learned-society-in-a-period-of-transition-suny-series.pdf
    • http://www.gorillawalker.com/pinch-pottery-functional-modern-handbuilding.pdf
    • http://www.gorillawalker.com/foundations-of-statistical-natural-language-processing.pdf
    • http://www.gorillawalker.com/cumberland-odyssey-a-journey-in-pictures-and-words-along-tennessee.pdf
    • http://www.gorillawalker.com/farm-vehicles-my-first-my-first-sound-book.pdf
    • http://www.gorillawalker.com/abundantly-you-on-purpose-in-business-face-the-fear-of.pdf
    • http://www.gorillawalker.com/procedures-theory-for-administrative-professionals-print-replica-kindle-edition.pdf
    • http://www.gorillawalker.com/instrument-engineers-handbook-third-edition-process-measurement-and-analysis.pdf
    • http://www.gorillawalker.com/two-roads-to-wisdom-chinese-and-analytic-philosophical-traditions.pdf
    • http://www.gorillawalker.com/a-show-of-force-frontiers-saga-book-13-unabridged-audible.pdf
    • http://www.gorillawalker.com/pictorial-law-modern-law-and-the-power-of-pictures.pdf
    • http://www.gorillawalker.com/deception-the-invisible-war-between-the-kgb-and-the-cia.pdf
    • http://www.gorillawalker.com/preoccupations-selected-prose-1968-1978.pdf
    • http://www.gorillawalker.com/use-professional-firewall-to-manage-stress-work-life-balance-for.pdf
    • http://www.gorillawalker.com/parole-au-corps-essai-french-edition.pdf
    • http://www.gorillawalker.com/aaron-brooks-rise-above-football-positively-for-kids-book.pdf
    • http://www.gorillawalker.com/building-king-s-beloved-community-foundations-for-pastoral-care-and.pdf
    • http://www.gorillawalker.com/writing-for-others-writing-for-ourselves-telling-stories-in-an.pdf
    • http://www.gorillawalker.com/la-prehist-ria.pdf
    • http://www.gorillawalker.com/pausanias-guide-to-ancient-greece-sather-classical-lectures.pdf
    • http://www.gorillawalker.com/engaging-islam.pdf
    • http://www.gorillawalker.com/the-official-gre-cgs-directory-of-graduate-programs-natural-sciences.pdf
    • http://www.gorillawalker.com/psychology-of-health-and-fitness-applications-for-behavior-change-foundations.pdf
    • http://www.gorillawalker.com/il-tait-une-fois-la-reine-et-la-voleuse-french.pdf
    • http://www.gorillawalker.com/kender-gully-dwarves-and-gnomes-volume-2-dragonlance-tales.pdf
    • http://www.gorillawalker.com/honda-motorcycle-manual-all-models-singles-and-twins-1960-1966.pdf
    • http://www.gorillawalker.com/trinity-one-god-three-persons-people-s-bible-teachings-kindle.pdf
    • http://www.gorillawalker.com/entrepreneurship-owning-your-future-high-school-textbook-11th-edition.pdf
    • http://www.gorillawalker.com/the-sunday-worship-duet-book-hymns-classics-and-songs-of.pdf
    • http://www.gorillawalker.com/il-viaggio-a-reims-the-journey-to-rheims-vocal-score.pdf
    • http://www.gorillawalker.com/never-let-you-go-a-modern-fairytale.pdf
    • http://www.gorillawalker.com/integrating-risk-management-and-asse
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.