Malicious PDF — malware analysis report

Static analysis result for SHA-256 b80daa0e284c18e5…

MALICIOUS

PDF

42.5 KB Created: 2018-11-14 08:20:56 +03:00 Authoring application: Adobe InDesign CS4 (6.0.6) (via Adobe PDF Library 9.0)
MD5: 5c684c2dbe284d13d75784f994a4afe7 SHA-1: fd253c1740cd90d24162055d76352a42384f3e45 SHA-256: b80daa0e284c18e567577c2539a5450bd92a47837984f1b32176b5c18c90c91c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing 32 external links. The embedded URLs point to various PDF documents hosted on www.gorillawalker.com. While no scripts were extracted, the sheer volume of links suggests a malicious intent, possibly for SEO manipulation or to serve as a distribution point for further malicious content. The attack pattern is consistent with a phishing or content-luring technique.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/heidegger-dilthey-and-the-crisis-of-historicism.pdf
    • http://www.gorillawalker.com/the-last-of-the-railroad-police-paperback.pdf
    • http://www.gorillawalker.com/ketogenic-diet-the-ultimate-beginner-s-guide-for-understanding-the.pdf
    • http://www.gorillawalker.com/gardening-in-the-desert-southwest-2010-wall-calendar.pdf
    • http://www.gorillawalker.com/malachi-mccormick-s-irish-country-cooking.pdf
    • http://www.gorillawalker.com/the-enigma-of-chess-intuition-can-you-mobilize-hidden-forces.pdf
    • http://www.gorillawalker.com/wild-ideas.pdf
    • http://www.gorillawalker.com/charmed-thirds.pdf
    • http://www.gorillawalker.com/path-between-the-seas-the-creation-of-the-panama-canal.pdf
    • http://www.gorillawalker.com/beyond-south-asia-india-s-strategic-evolution-and-the-reintegration.pdf
    • http://www.gorillawalker.com/women-land-and-justice-in-tanzania-eastern-africa-series.pdf
    • http://www.gorillawalker.com/spend-analysis-the-window-into-strategic-sourcing.pdf
    • http://www.gorillawalker.com/lebanon-a-model-of-consociational-conflict-european-university-studies-europaische.pdf
    • http://www.gorillawalker.com/compost-utilization-in-horticultural-cropping-systems-kindle-edition.pdf
    • http://www.gorillawalker.com/string-quartets-opp-42-50-and-54-dover-chamber-music.pdf
    • http://www.gorillawalker.com/the-rough-guide-to-florence-2-rough-guide-mini-guides.pdf
    • http://www.gorillawalker.com/national-geographic-september-1999-vol-196-no-3.pdf
    • http://www.gorillawalker.com/the-greatest-games-of-all-time-wiley-science-editions.pdf
    • http://www.gorillawalker.com/let-s-play-soccer-beginning-to-read.pdf
    • http://www.gorillawalker.com/in-search-of-human-nature-the-decline-and-revival-of.pdf
    • http://www.gorillawalker.com/computer-simulated-experiments-for-electronic-devices-using-electronics-workbench-2nd.pdf
    • http://www.gorillawalker.com/optical-absorption-of-impurities-and-defects-in-semiconducting-crystals-hydrogen.pdf
    • http://www.gorillawalker.com/student-solutions-manual-for-masterton-hurley-neth-s-chemistry-principles.pdf
    • http://www.gorillawalker.com/plumbing-design-and-installation-reference-guide-mcgraw-hill-engineering-reference.pdf
    • http://www.gorillawalker.com/il-vino-del-papa-italian-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/organizational-behavior-an-evidence-based-approach-13th-ed.pdf
    • http://www.gorillawalker.com/adhesives-technology-compendium-2009.pdf
    • http://www.gorillawalker.com/construction-documents-using-sketchup-pro-layout-replace-traditional-cad-with.pdf
    • http://www.gorillawalker.com/ultimate-success.pdf
    • http://www.gorillawalker.com/together-forever-across-time-train-through-time-series-book-2.pdf
    • http://www.gorillawalker.com/brilliant-manoeuvres-how-to-use-military-wisdom-to-win-business.pdf
    • http://www.gorillawalker.com/aunt-evie.pdf
    • http://www.gorillawalker.com/on-the-practice-of-sociology-heritage-of-sociology-series.pdf
    • http://www.gorillawalker.com/rigadoon.pdf
    • http://www.gorillawalker.com/dear-diary-paperback.pdf
    • http://www.gorillawalker.com/landranger-maps-glasgow-and-surrounding-area-sheet-64-os-landranger.pdf
    • http://www.gorillawalker.com/era-the-history-of-english-racing-automobiles.pdf
    • http://www.gorillawalker.com/gluten-free-every-day-cookbook-more-than-100-easy-and.pdf
    • http://www.gorillawalker.com/computers-in-your-future-2004.pdf
    • http://www.gorillawalker.com/2006-code-of-federal-regulations-title-46-shipping-parts-1.pdf
    • http://www.gorillawalker.c
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.