Malicious PDF — malware analysis report

Static analysis result for SHA-256 b84ab119f634ff85…

MALICIOUS

PDF

40.7 KB Created: 2018-11-15 19:33:46 +03:00 Authoring application: AH XSL Formatter V6.1 MR1 for Linux64 : 6.1.6.12100 (via Antenna House PDF Output Library 6.1.420 (Linux64); modified using iText 2.1.7 by 1T3XT)
MD5: 32094cd3b3cca21fa0e9a31946b692ca SHA-1: 6dff11e85b2a48a65fed2237b6470f4e339c6afe SHA-256: b84ab119f634ff85f08091e54d5b7292eb3e12a8f6a228fe15e7ed73a723433b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of embedded external links, characteristic of a link farm or SEO spam campaign. The primary purpose appears to be directing users to a collection of PDF documents hosted on gorillawalker.com. No scripts were extracted, and the document body contained obfuscated data and URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/emerging-perspectives-on-anti-oppressive-practice.pdf
    • http://www.gorillawalker.com/ronin-skirmish-wargames-in-the-age-of-the-samurai-osprey.pdf
    • http://www.gorillawalker.com/there-are-no-problem-horses-only-problem-riders.pdf
    • http://www.gorillawalker.com/the-fallen-sentinel.pdf
    • http://www.gorillawalker.com/your-mba-game-plan-third-edition-proven-strategies-for-getting.pdf
    • http://www.gorillawalker.com/transitions-leading-churches-through-change.pdf
    • http://www.gorillawalker.com/frida-kahlo-the-paintings.pdf
    • http://www.gorillawalker.com/landon-and-the-leatherback-sea-turtle.pdf
    • http://www.gorillawalker.com/by-carl-s-warren-financial-accounting-9th-nineth-edition.pdf
    • http://www.gorillawalker.com/to-the-finland-station-a-study-in-the-writing-and.pdf
    • http://www.gorillawalker.com/the-handbook-of-international-marketing-communications.pdf
    • http://www.gorillawalker.com/linking-objects-and-linking-phenomena.pdf
    • http://www.gorillawalker.com/no-regret.pdf
    • http://www.gorillawalker.com/love-triangle-ronald-reagan-jane-wyman-nancy-davis-all-the.pdf
    • http://www.gorillawalker.com/tai-chi-chuan-silk-reeling-exercises.pdf
    • http://www.gorillawalker.com/la-libertad-como-herej-a-andanzas-spanish-edition.pdf
    • http://www.gorillawalker.com/crazy-wisdom.pdf
    • http://www.gorillawalker.com/the-physical-principles-of-magnetism.pdf
    • http://www.gorillawalker.com/nanosensors-physical-chemical-and-biological-series-in-sensors.pdf
    • http://www.gorillawalker.com/the-archaeology-of-social-boundaries-smithsonian-series-in-archaeological-inquiry.pdf
    • http://www.gorillawalker.com/on-common-laws.pdf
    • http://www.gorillawalker.com/the-proposition-book-2-illicit-proposition-billionaire-boss.pdf
    • http://www.gorillawalker.com/slavery-opposing-viewpoints-digests.pdf
    • http://www.gorillawalker.com/distributed-feedback-laser-diodes-principles-and-physical-modelling.pdf
    • http://www.gorillawalker.com/turtle-bay-a-beach-read-seasons-of-love-book-1.pdf
    • http://www.gorillawalker.com/operative-neuromodulation-volume-2-neural-networks-surgery-acta-neurochirurgica-supplement.pdf
    • http://www.gorillawalker.com/essentials-of-psychiatric-mental-health-nursing-concepts-of-care-in.pdf
    • http://www.gorillawalker.com/fuerzas-especiales-largo-recorrido-spanish-edition.pdf
    • http://www.gorillawalker.com/understanding-hospital-billing-and-coding-2e.pdf
    • http://www.gorillawalker.com/physics-the-physical-setting-brief-review-for-new-york.pdf
    • http://www.gorillawalker.com/springboard-to-german-introduction-to-the-german-language.pdf
    • http://www.gorillawalker.com/concerto-op-14-corrected-revised-version-for-violin-and-orchestra.pdf
    • http://www.gorillawalker.com/captain-jack-father-of-the-yukon.pdf
    • http://www.gorillawalker.com/how-to-gamble-if-you-must-inequalities-for-stochastic-processes.pdf
    • http://www.gorillawalker.com/3-pi-ces-pour-orchestre-op-96-valse-chevaleresque-no.pdf
    • http://www.gorillawalker.com/advanced-geometry-grades-7-10.pdf
    • http://www.gorillawalker.com/st-dragon-girl-vol-5.pdf
    • http://www.gorillawalker.com/james-journey-to-the-amusement-park.pdf
    • http://www.gorillawalker.com/foreclosure-survival-guide-the-keep-your-house-or-walk-away.pdf
    • http://www.gorillawalker.com/marine-insurance-origins-and-institutions-1300-1850-palgrave-studies-in.pdf
    • http://www.gorillawalker.com/by-carl-s-warren-financial-accountin
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.