Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0fccefdb79684f6…

MALICIOUS

PDF

43.5 KB Created: 2018-12-02 20:10:02 +03:00 Authoring application: PrimoPDF http://www.primopdf.com/ (via PrimoPDF)
MD5: 29b7eca9b62ba3b17f484704d5f9dd4d SHA-1: 5b8b532dd8799ac0a75c4d0c3b8f7518fc3a7663 SHA-256: c0fccefdb79684f636daea784964f87474e072e57381478a46a86ccfa74c43b8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded links, all pointing to URLs on www.gorillawalker.com, suggest a coordinated effort to manipulate search engine results or to distribute a large volume of content, potentially malicious, to unsuspecting users. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9007

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/empowered-volume-1.pdf
    • http://www.gorillawalker.com/rainforest-kingfisher-voyages-kingfisher-voyages.pdf
    • http://www.gorillawalker.com/solfeo-de-los-solfeos-book-i-voice-technique.pdf
    • http://www.gorillawalker.com/rivers-in-action-earth-s-changing-landscape.pdf
    • http://www.gorillawalker.com/sword-and-shield.pdf
    • http://www.gorillawalker.com/best-hikes-with-kids-san-francisco-bay-area.pdf
    • http://www.gorillawalker.com/lectionary-worship-workbook-series-ii-cycle-b.pdf
    • http://www.gorillawalker.com/dragon-seer.pdf
    • http://www.gorillawalker.com/fantasy-football-playing-to-win.pdf
    • http://www.gorillawalker.com/worldtariff-guidebook-on-customs-tariff-schedules-of-import-duties-for.pdf
    • http://www.gorillawalker.com/coronation-march-op-65-original-orchestra-tuba-part-qty-3.pdf
    • http://www.gorillawalker.com/miracle-lane-miracle-interrupted-volume-5.pdf
    • http://www.gorillawalker.com/crazy-horses-author-lampert-claudia.pdf
    • http://www.gorillawalker.com/nimrod-the-extraordinary-story-of-shackleton-s-first-expedition.pdf
    • http://www.gorillawalker.com/fund-spy-morningstar-s-inside-secrets-to-selecting-mutual-funds.pdf
    • http://www.gorillawalker.com/cours-de-philosophie-tome-2-m-taphysique-g-n-rale.pdf
    • http://www.gorillawalker.com/the-complete-guide-to-food-allergy-and-intolerance.pdf
    • http://www.gorillawalker.com/death-cakes-a-cozy-murder-mystery-kindle-edition.pdf
    • http://www.gorillawalker.com/the-tales-of-prince-samuttakote-a-buddhist-epic-from-thailand.pdf
    • http://www.gorillawalker.com/reckless-paperback.pdf
    • http://www.gorillawalker.com/pesticides-advice-and-recommendations-to-be-used-by-national-and.pdf
    • http://www.gorillawalker.com/a-revela-o-do-livro-do-zohar-em-nosso-tempo.pdf
    • http://www.gorillawalker.com/j-n-loughborough-the-last-of-the-adventist-pioneers.pdf
    • http://www.gorillawalker.com/word-search-books-of-the-bible.pdf
    • http://www.gorillawalker.com/fixing-your-computer-absolute-beginner-s-guide-kindle-edition.pdf
    • http://www.gorillawalker.com/country-cottages-and-gardens-wall-2013.pdf
    • http://www.gorillawalker.com/the-age-of-paper-consolidation-of-the-water-power-at.pdf
    • http://www.gorillawalker.com/coring-operations-procedures-for-sampling-and-analysis-of-bottomhole-and.pdf
    • http://www.gorillawalker.com/beginner-s-guide-to-buddhist-meditation-practices-for-mindful-living.pdf
    • http://www.gorillawalker.com/new-zealand-in-colour-v-1.pdf
    • http://www.gorillawalker.com/las-recetas-de-el-comidista-spanish-edition.pdf
    • http://www.gorillawalker.com/floricanto-en-aztlan.pdf
    • http://www.gorillawalker.com/old-boston-taverns-1886-reprint.pdf
    • http://www.gorillawalker.com/maimonides-between-philosophy-and-halakhah-rabbi-joseph-b-soloveitchik-146.pdf
    • http://www.gorillawalker.com/ten-steps-to-advanced-reading-2-e.pdf
    • http://www.gorillawalker.com/microsoft-windows-8.pdf
    • http://www.gorillawalker.com/ben-hur-by-general-lew-wallace-and-beau-gest-by.pdf
    • http://www.gorillawalker.com/pieces-of-me-kindle-edition.pdf
    • http://www.gorillawalker.com/pornography-and-silence-culture-s-revenge-against-nature.pdf
    • http://www.gorillawalker.com/fresno-growing-up-a-city-comes-of-age-1945-1985.pdf
    • http://www.primopdf.com/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.