Malicious PDF — malware analysis report

Static analysis result for SHA-256 c10dbaadee72b10a…

MALICIOUS

PDF

45.4 KB Created: 2018-12-07 18:28:06 +03:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 8.0.0 (Windows))
MD5: b0d32d3421a49496e2a3de9fe5fff0a2 SHA-1: 9d655629ebf08081da8d1a32c76eb1784f403021 SHA-256: c10dbaadee72b10ab9cc97736e329854595c64558032aa81b0448711ccdae737
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file was flagged by a critical heuristic for containing a mass external PDF link farm, with 32 links identified. The majority of these links point to book titles on the domain 'gorillawalker.com'. This suggests a tactic to artificially inflate search engine rankings or to distribute potentially malicious content disguised as legitimate resources. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8812

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/sams-teach-yourself-html-css-and-javascript-all-in-one.pdf
    • http://www.gorillawalker.com/how-to-be-a-domestic-goddess-baking-and-the-art.pdf
    • http://www.gorillawalker.com/the-earth-the-temple-and-the-gods-greek-sacred-architecture.pdf
    • http://www.gorillawalker.com/the-aids-dictionary.pdf
    • http://www.gorillawalker.com/marine-technology-operations-theory-practice.pdf
    • http://www.gorillawalker.com/the-lord-s-prayer-a-secret-code-revealed-code-of.pdf
    • http://www.gorillawalker.com/the-political-economy-of-the-regional-comprehensive-economic-partnership-rcep.pdf
    • http://www.gorillawalker.com/les-eglises-rupestres-de-la-region-des-lacs-d-ohrid.pdf
    • http://www.gorillawalker.com/teach-me-everyday-french-volume-2-celebrating-the-seasons-french.pdf
    • http://www.gorillawalker.com/weed-ecology-implications-for-management.pdf
    • http://www.gorillawalker.com/slash-the-autobiography-signed.pdf
    • http://www.gorillawalker.com/tales-of-angria-penguin-classics.pdf
    • http://www.gorillawalker.com/higher-chemistry-2015-16-sqa-specimen-past-and-hodder-gibson.pdf
    • http://www.gorillawalker.com/the-education-of-laura-bridgman-first-deaf-and-blind-person.pdf
    • http://www.gorillawalker.com/inclusion-no-nonsense-series.pdf
    • http://www.gorillawalker.com/until-she-sleeps-kindle-edition.pdf
    • http://www.gorillawalker.com/instrumentation-control-and-automation-of-water-and-wastewater-treatment-and.pdf
    • http://www.gorillawalker.com/digital-type-motif-design.pdf
    • http://www.gorillawalker.com/tus-zonas-err-neas-gu-a-para-combatir-las-causas.pdf
    • http://www.gorillawalker.com/nelly-sachs-flight-and-metamorphosis-an-illustrated-biography.pdf
    • http://www.gorillawalker.com/clinical-anatomy-and-physiology-for-veterinary-technicians-2e.pdf
    • http://www.gorillawalker.com/original-jaguar-mki-and-mkii-the-restorer-s-guide-to.pdf
    • http://www.gorillawalker.com/el-dios-de-darwin-coleccion-ancora-y-delfin-spanish-edition.pdf
    • http://www.gorillawalker.com/the-mongol-empire-genghis-khan-his-heirs-and-the-founding.pdf
    • http://www.gorillawalker.com/green-functions-for-ordered-and-disordered-systems-studies-in-mathematical.pdf
    • http://www.gorillawalker.com/bescherelle-bescherelle-poche-mieux-rediger-french-edition.pdf
    • http://www.gorillawalker.com/555-timer-applications-source-book-with-experiments-blacksburg-continuing-education.pdf
    • http://www.gorillawalker.com/struwwelpeter-and-other-disturbing-tales-for-human-beings-a-blab.pdf
    • http://www.gorillawalker.com/be-a-sales-superstar-21-great-ways-to-sell-more.pdf
    • http://www.gorillawalker.com/born-killers-childhood-secrets-of-the-world-s-deadliest-serial.pdf
    • http://www.gorillawalker.com/frogs-national-geographic-readers.pdf
    • http://www.gorillawalker.com/welding-fundamentals-and-procedures.pdf
    • http://www.gorillawalker.com/undetermined-ukrainians-post-war-narratives-of-the-waffen-ss-galicia.pdf
    • http://www.gorillawalker.com/there-is-nothing-wrong-with-you-for-teens.pdf
    • http://www.gorillawalker.com/constitutional-and-political-history-of-pakistan.pdf
    • http://www.gorillawalker.com/one-palestine-complete.pdf
    • http://www.gorillawalker.com/shedding-life-disease-politics-and-other-human-conditions.pdf
    • http://www.gorillawalker.com/medical-biostatistics-epidemiology-examination-board-review.pdf
    • http://www.gorillawalker.com/la-sutil-artima-a-de-satan-s-los-dos-esp.pdf
    • http://www.gorillawalker.com/annabelle.pdf
    • http://www.gorillawalker.com/the-lord-s-prayer-a-se
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.