Malicious PDF — malware analysis report

Static analysis result for SHA-256 c2e910c0f1e40c5e…

MALICIOUS

PDF

45.0 KB Created: 2018-11-14 11:21:31 +03:00 Authoring application: Adobe Acrobat 7.0 (via Adobe Acrobat 7.0 Image Conversion Plug-in)
MD5: b0d56818d30968cbe5f9d09b13cf479e SHA-1: 6c611c6013db9d45b8dab8fc34ba4ae298f6ed85 SHA-256: c2e910c0f1e40c5eaaafd83c99b39c284acbe34450949def4f1958d29a8a4f18
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier and contains a large number of external links, indicating a potential SEO manipulation or content distribution scheme. The primary heuristic identified a link farm pointing to numerous PDF files hosted on www.gorillawalker.com. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8812

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-giver-and-his-gifts-kindle-edition.pdf
    • http://www.gorillawalker.com/conservaci-n-de-vidrieras-hist-ricas-an-lisis-y-diagn.pdf
    • http://www.gorillawalker.com/open-mind-open-heart-the-contemplative-dimension-of-the-gospel.pdf
    • http://www.gorillawalker.com/machu-picchu-city-in-the-clouds-high-interest-books-digging.pdf
    • http://www.gorillawalker.com/introduction-to-declarers-play.pdf
    • http://www.gorillawalker.com/national-board-of-chiropractic-part-iii-study-guide-key-review.pdf
    • http://www.gorillawalker.com/hello-charlie-letters-from-a-serial-killer.pdf
    • http://www.gorillawalker.com/roni-horn-another-water.pdf
    • http://www.gorillawalker.com/break-all-rules-punk-rock-and-the-making-of-a.pdf
    • http://www.gorillawalker.com/the-reef-aquarium-a-comprehensive-guide-to-the-identification-and.pdf
    • http://www.gorillawalker.com/ip-for-4g.pdf
    • http://www.gorillawalker.com/hoy-aprendo-a-contar-castellano-franc.pdf
    • http://www.gorillawalker.com/twenty-two-yards-to-freedom-a-social-history-of-indian.pdf
    • http://www.gorillawalker.com/exam-prep-for-finite-mathematics-an-applied-approach-by-sullivan.pdf
    • http://www.gorillawalker.com/heidegger-his-life-and-his-philosophy-insurrections-critical-studies-in.pdf
    • http://www.gorillawalker.com/digital-marketing-a-practical-approach.pdf
    • http://www.gorillawalker.com/the-flip-kindle-edition.pdf
    • http://www.gorillawalker.com/coyote-places-the-stars-aladdin-picture-books.pdf
    • http://www.gorillawalker.com/atkins-diabetes-revolution-kindle-edition.pdf
    • http://www.gorillawalker.com/lsat-68-explanations-a-study-guide-for-lsat-preptest-68.pdf
    • http://www.gorillawalker.com/instructor-s-solutions-manual-to-accompany-holt-calculus-with-analytic.pdf
    • http://www.gorillawalker.com/austria-burgenland-styria-steiermark-1-150-000-recreation-map-2.pdf
    • http://www.gorillawalker.com/liberia-countries-around-the-world.pdf
    • http://www.gorillawalker.com/soils-soil-fertility-2nd-edition.pdf
    • http://www.gorillawalker.com/sister-a-novel.pdf
    • http://www.gorillawalker.com/blue-neon-night-michael-connelly-s-los-angeles-dvd.pdf
    • http://www.gorillawalker.com/object-oriented-implementation-of-numerical-methods-an-introduction-with-java.pdf
    • http://www.gorillawalker.com/menopause-symbol-2013-isbn-4120044653-japanese-import.pdf
    • http://www.gorillawalker.com/cases-and-materials-on-torts-edition-8.pdf
    • http://www.gorillawalker.com/2012-national-construction-of-two-qualification-exam-four-years-zhenti.pdf
    • http://www.gorillawalker.com/universal-access-in-health-telematics-a-design-code-of-practice.pdf
    • http://www.gorillawalker.com/fuzzy-randomness-uncertainty-in-civil-engineering-and-computational-mechanics-engineering.pdf
    • http://www.gorillawalker.com/neo-nazis-a-growing-threat-issues-in-focus.pdf
    • http://www.gorillawalker.com/ein-urlaub-in-d-nemark.pdf
    • http://www.gorillawalker.com/the-migration-ecology-of-birds.pdf
    • http://www.gorillawalker.com/handbook-of-research-on-teaching-literacy-through-the-communicative-and.pdf
    • http://www.gorillawalker.com/chinese-ceramics-from-the-paleolithic-period-through-the-qing-dynasty.pdf
    • http://www.gorillawalker.com/italian-idioms-phrases-idiomatic-expressions-everyday-phrases-proverbs.pdf
    • http://www.gorillawalker.com/the-skinny-gut-diet-balance-your-digestive-system-for-permanent.pdf
    • http://www.gorillawalker.com/theory-and-practice-of-water-and-wastewater-treatment.pdf
    • http://www.gorillawalker.com/hello-charl
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.