Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2b6cbef16028736…

MALICIOUS

PDF

44.6 KB Created: 2019-01-06 08:02:23 +03:00 Authoring application: Documill Publishor 6.3.9.1 by Documill (http://www.documill.com/) (via iText 2.1.6 by 1T3XT)
MD5: 915fb6d9edc31091439b9a0a019fc640 SHA-1: 33ed4067658839423cbbbd5cda1c7805f48b0ca7 SHA-256: c2b6cbef16028736ed8ec27782ecf44966a24add04dcbe2399504de7c0c3e31e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute malicious content. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8452

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/ox-cart-to-automobile-social-change-in-western-new-york.pdf
    • http://www.gorillawalker.com/little-missouri-little-state.pdf
    • http://www.gorillawalker.com/the-evolving-arab-city-tradition-modernity-and-urban-development-planning.pdf
    • http://www.gorillawalker.com/calling-dr-laura-a-graphic-memoir.pdf
    • http://www.gorillawalker.com/medical-terminology-quick-concise-by-willis-cma-ac-marjorie-canfield.pdf
    • http://www.gorillawalker.com/the-infantry-rifle-and-platoon-squad-the-official-u-s.pdf
    • http://www.gorillawalker.com/geology-of-cambodia-laos-and-vietnam-explanatory-note-to-the.pdf
    • http://www.gorillawalker.com/el-portugues-spanish-edition.pdf
    • http://www.gorillawalker.com/a-game-of-thrones-card-game-beyond-the-wall-chapter.pdf
    • http://www.gorillawalker.com/amazing-spider-man.pdf
    • http://www.gorillawalker.com/10-secrets-of-bowling-classic-reprint.pdf
    • http://www.gorillawalker.com/a-caballo-equitacion-para-principiantes-spanish-edition.pdf
    • http://www.gorillawalker.com/monkey-on-my-back-digital.pdf
    • http://www.gorillawalker.com/hormones-and-growth-factors-in-development-and-neoplasia.pdf
    • http://www.gorillawalker.com/casos-de-dise-o.pdf
    • http://www.gorillawalker.com/lonely-planet-norway-video-videos-vhs.pdf
    • http://www.gorillawalker.com/holiness-its-nature-hindrances-difficulties-and-roots.pdf
    • http://www.gorillawalker.com/no-tears-in-heaven.pdf
    • http://www.gorillawalker.com/steck-vaughn-ged-official-practice-test-3-1-interim-network.pdf
    • http://www.gorillawalker.com/ball-busters-golf.pdf
    • http://www.gorillawalker.com/financial-accounting-introduction-to-concepts-methods-and-uses-with-1.pdf
    • http://www.gorillawalker.com/my-spartan-hellion-volume-1.pdf
    • http://www.gorillawalker.com/instant-healing-accessing-creative-intelligence-for-healing-body-and-soul.pdf
    • http://www.gorillawalker.com/whisky.pdf
    • http://www.gorillawalker.com/insulin-resistance-diet-top-50-insulin-resistance-meals-loss-fat.pdf
    • http://www.gorillawalker.com/the-silver-sword-a-puffin-book.pdf
    • http://www.gorillawalker.com/noise-control-in-industry-third-edition.pdf
    • http://www.gorillawalker.com/two-tales-1-an-erotic-story-2-pack-kindle-edition.pdf
    • http://www.gorillawalker.com/unfinished-voyages-western-australilan-shipwrecks-1622-1850-second-edition-v.pdf
    • http://www.gorillawalker.com/the-unofficial-10-day-green-smoothie-cleanse-recipe-collection-divas.pdf
    • http://www.gorillawalker.com/cardiac-surgery-safeguards-and-pitfalls-in-operative-technique.pdf
    • http://www.gorillawalker.com/beyond-the-burning-cross-a-landmark-case-of-race-censorship.pdf
    • http://www.gorillawalker.com/a-career-in-medicine-do-you-have-what-it-takes.pdf
    • http://www.gorillawalker.com/breve-historia-de-las-religiones-del-mundo-spanish-edition-kindle.pdf
    • http://www.gorillawalker.com/accounting-a-very-short-introduction-very-short-introductions.pdf
    • http://www.gorillawalker.com/power-forward-my-presidential-education-kindle-edition.pdf
    • http://www.gorillawalker.com/how-minority-students-experience-college-implications-for-planning-and-policy.pdf
    • http://www.gorillawalker.com/between-riverside-and-crazy.pdf
    • http://www.gorillawalker.com/iron-butterfly-spread-a-simple-options-trading-strategy-for-consistent.pdf
    • http://www.documill.com/
    • http://www.gorillawalker.com/geo
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.