Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd7ae03cb6a18ada…

MALICIOUS

PDF

33.9 KB Created: 2019-05-24 00:42:53 +03:00 Authoring application: - (via ProcessText Group)
MD5: 642f289009d45a7f9fc43068cea1ba34 SHA-1: c3d1648c356a107abdb60b59de6d64e32cf89623 SHA-256: bd7ae03cb6a18ada4107a50556e530a9517a2b3002270de1b1c701540773aa5a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, primarily 'gorillawalker.com', and are likely intended to manipulate search engine rankings or redirect users to potentially malicious websites. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of this document. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8015

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-cosmo-bikini-diet-lose-15-pounds-get-a-sexy.pdf
    • http://www.gorillawalker.com/fifty-shades-of-pink.pdf
    • http://www.gorillawalker.com/solid-state-electronic-devices-6th-edition.pdf
    • http://www.gorillawalker.com/bernard-berenson-the-making-of-a-legend.pdf
    • http://www.gorillawalker.com/liberating-narratives-the-authorization-of-black-female-voices-in-african.pdf
    • http://www.gorillawalker.com/jps-tanakh-the-holy-scriptures-blue-the-new-jps-translation.pdf
    • http://www.gorillawalker.com/wizard-s-spell-compendium-vol-2-advanced-dungeons-dragons.pdf
    • http://www.gorillawalker.com/easy-classical-bassoon-solos-japanese-edition.pdf
    • http://www.gorillawalker.com/ancient-greece-history-in-art.pdf
    • http://www.gorillawalker.com/marcha-latino-chicago-and-the-immigrant-rights-movement-latinos-in.pdf
    • http://www.gorillawalker.com/the-busy-manager-s-guide-to-delegation-worksmart-series.pdf
    • http://www.gorillawalker.com/the-new-international-webster-s-student-dictionary.pdf
    • http://www.gorillawalker.com/paper-london-build-your-own-metropolis-in-20-models-30.pdf
    • http://www.gorillawalker.com/graph-drawing-algorithms-for-the-visualization-of-graphs.pdf
    • http://www.gorillawalker.com/when-hell-freeze-over.pdf
    • http://www.gorillawalker.com/guido-s-gondola.pdf
    • http://www.gorillawalker.com/always-we-begin-again-the-benedictine-way-of-living-gift.pdf
    • http://www.gorillawalker.com/the-master-plan-a-story-of-faith-hope-forgiveness-love.pdf
    • http://www.gorillawalker.com/first-quintet-in-d-major-for-two-violins-viola-cello.pdf
    • http://www.gorillawalker.com/introduction-to-symmetry-analysis-with-cd-rom-cambridge-texts-in.pdf
    • http://www.gorillawalker.com/bitcoin-algorithm-kindle-edition.pdf
    • http://www.gorillawalker.com/ghost-rider-travels-on-the-healing-road.pdf
    • http://www.gorillawalker.com/food-poisoning-and-food-infections.pdf
    • http://www.gorillawalker.com/sonata-hallenser-no2-e-minor-flute-and-basso-continuo-old.pdf
    • http://www.gorillawalker.com/lenny-the-crow.pdf
    • http://www.gorillawalker.com/the-anxious-girl-s-guide-to-dating-how-to-find.pdf
    • http://www.gorillawalker.com/agency-partnerships-and-limited-liability-entities-unincorparated-business-associations-university.pdf
    • http://www.gorillawalker.com/the-dorling-kindersley-children-s-illustrated-encyclopedia.pdf
    • http://www.gorillawalker.com/5-steps-to-a-5-ap-english-literature-2012-2013.pdf
    • http://www.gorillawalker.com/oracle-database-12c-the-complete-reference-oracle-press.pdf
    • http://www.gorillawalker.com/encyclopedia-of-legendary-creatures.pdf
    • http://www.gorillawalker.com/praise-vilification-and-sexual-innuendo-or-how-to-be-a.pdf
    • http://www.gorillawalker.com/managing-health-services-concepts-and-practice-2e.pdf
    • http://www.gorillawalker.com/el-metasecreto-el-promixo-nivel-spanish-edition.pdf
    • http://www.gorillawalker.com/futureprofits-empowering-youth-to-make-wise-decisions-about-life-and.pdf
    • http://www.gorillawalker.com/sydney-s-spaceship-the-charm-series-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/merry-in-love-billionaires-in-love-book-5.pdf
    • http://www.gorillawalker.com/militarische-fernglaser-und-fernrohre-in-heer-luftwaffe-und-marine-military.pdf
    • http://www.gorillawalker.com/guide-for-the-selection-of-communication-equipment-for-emergency-first.pdf
    • http://www.gorillawalker.com/obras-primas-da-m-sica-cl-ssica-para-a-escaleta.pdf
    • http://www.gorillawalker.com/the-bus
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.