Malicious PDF — malware analysis report

Static analysis result for SHA-256 c106d821a09d263e…

MALICIOUS

PDF

40.3 KB Created: 2018-11-26 20:12:35 +03:00 Authoring application: Acrobat Distiller 7.0.5 (Windows)
MD5: 48d03f102e45e646c5c7ce3a2b1b8f4f SHA-1: c46d146c0ff55859c8f31dac9f1be0702a1368c1 SHA-256: c106d821a09d263e8baca6a32787da1b29031b9e90ffcf7f59c2297483396918
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. A critical heuristic identified a large number of external links, suggesting a link farm or distribution mechanism. The document body contains many URLs pointing to PDF files hosted on www.gorillawalker.com, which are likely the intended payload or lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/disappearing-coverage-editorials-one-quarter-of-u-s-will-be.pdf
    • http://www.gorillawalker.com/ferrari-days.pdf
    • http://www.gorillawalker.com/the-trials-of-persiles-and-sigismunda-a-northern-story-hackett.pdf
    • http://www.gorillawalker.com/the-real-estate-developer-s-handbook-how-to-set-up.pdf
    • http://www.gorillawalker.com/operation-massacre.pdf
    • http://www.gorillawalker.com/sister-sarah-s-pick-8-monthly-hot-tips-sheets-maker.pdf
    • http://www.gorillawalker.com/the-kingdoms-of-life-world-of-science-come-learn-with.pdf
    • http://www.gorillawalker.com/the-one-and-only-law-walter-benjamin-and-the-second.pdf
    • http://www.gorillawalker.com/the-2011-2016-outlook-for-multiple-sclerosis-therapeutics-in-india.pdf
    • http://www.gorillawalker.com/all-dogs-have-adhd-kindle-edition.pdf
    • http://www.gorillawalker.com/seven-pleasures-essays-on-ordinary-happiness.pdf
    • http://www.gorillawalker.com/resurrection-inc.pdf
    • http://www.gorillawalker.com/early-jazz-swing-songs-acoustic-guitar-method-songbook.pdf
    • http://www.gorillawalker.com/journal-your-life-s-journey-retro-lines-pattern-lined-journal.pdf
    • http://www.gorillawalker.com/the-eyes-of-a-king-the-last-descendants-1.pdf
    • http://www.gorillawalker.com/forms-of-nationhood-the-elizabethan-writing-of-england.pdf
    • http://www.gorillawalker.com/delta-blues-and-other-home-songs-strategies-for-communication-in.pdf
    • http://www.gorillawalker.com/narrative-of-the-life-of-frederick-douglass-an-american-slave.pdf
    • http://www.gorillawalker.com/the-leanin-dog.pdf
    • http://www.gorillawalker.com/gut-feelings-from-fear-and-despair-to-health-and-hope.pdf
    • http://www.gorillawalker.com/high-performance-computing-in-science-and-engineering-2000-transactions-of.pdf
    • http://www.gorillawalker.com/hamsters-2016-calendar.pdf
    • http://www.gorillawalker.com/scotland-for-backpackers.pdf
    • http://www.gorillawalker.com/syntax-theory-analysis-hsk-42-1-handbucker-zur-sprach-und.pdf
    • http://www.gorillawalker.com/manhattan-wolf-toda-una-dama-cuando-tu-no-miras-american.pdf
    • http://www.gorillawalker.com/shaka-zulu-the-biography-of-the-founder-of-the-zulu.pdf
    • http://www.gorillawalker.com/mini-cookbook-collection-best-of-bread-miniature-cookbook-collection.pdf
    • http://www.gorillawalker.com/asymptotic-modeling-of-atmospheric-flows.pdf
    • http://www.gorillawalker.com/true-devotion-to-mary-fully-restored-edition.pdf
    • http://www.gorillawalker.com/plant-engineers-and-managers-guide-to-energy-conservation-the-role.pdf
    • http://www.gorillawalker.com/starting-out-king-s-indian-starting-out-everyman-chess.pdf
    • http://www.gorillawalker.com/spirits-of-san-antonio-and-south-texas.pdf
    • http://www.gorillawalker.com/applied-sport-psychology-a-case-based-approach.pdf
    • http://www.gorillawalker.com/green-smoothies-diet-byopenshaw.pdf
    • http://www.gorillawalker.com/the-lunch-box-chronicles-notes-from-the-parenting-underground.pdf
    • http://www.gorillawalker.com/color-life-library-of-photography-revised-edition.pdf
    • http://www.gorillawalker.com/beryllium-chemistry-and-processing.pdf
    • http://www.gorillawalker.com/canonical-metrics-in-kaehler-geometry.pdf
    • http://www.gorillawalker.com/the-ladybird-illustrated-dictionary.pdf
    • http://www.gorillawalker.com/shadow-of-the-dragon.pdf
    • http://www.gorillawalker.com/the-one-and-only-law-walter-benjamin-and-the-se
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.