Malicious PDF — malware analysis report

Static analysis result for SHA-256 c68098300f77a978…

MALICIOUS

PDF

47.0 KB Created: 2018-11-14 08:16:38 +03:00 Authoring application: FrameMaker 7.1 (via Acrobat Distiller 7.0.5 (Windows)) First seen: 2018-11-20
MD5: b983d770d7655467c0fccd4bf3c9ac46 SHA-1: deef56850b33b47840470ffb76629df784c45a0b SHA-256: c68098300f77a9781e5fde3237ebf4a0ab54b8c17c37ade69d6e3051994f4bdb
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The ML classifier flagged this PDF as malicious with a high score. The document contains multiple embedded URLs pointing to PDF files hosted on the domain 'gorillawalker.com'. While no scripts were extracted, the presence of these links suggests a social engineering attempt to trick users into downloading further content, which could be malicious. The attack pattern is inferred from the nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8692

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/student-manual-for-theory-practice-of-group-counseling.pdf In PDF document text
    • http://www.gorillawalker.com/star-wars-workbook-preschool-shapes-colors-and-patterns.pdfIn PDF document text
    • http://www.gorillawalker.com/the-true-gospel-preached-here.pdfIn PDF document text
    • http://www.gorillawalker.com/progestins-and-antiprogestins-in-clinical-practice.pdfIn PDF document text
    • http://www.gorillawalker.com/pantone-35-inspirational-color-palletes.pdfIn PDF document text
    • http://www.gorillawalker.com/theory-as-resistance-politics-and-culture-after-post-structuralism.pdfIn PDF document text
    • http://www.gorillawalker.com/ethics-education-of-business-leaders-emotional-intelligence-virtues-and-contemplative.pdfIn PDF document text
    • http://www.gorillawalker.com/comfort-spice-recipes-for-modern-living-new-voices-in-food.pdfIn PDF document text
    • http://www.gorillawalker.com/the-convenient-groom-nantucket-love-story-series-2.pdfIn PDF document text
    • http://www.gorillawalker.com/spider-man-2015-premium-wall-calendar.pdfIn PDF document text
    • http://www.gorillawalker.com/do-you-inspiration-and-encouragement-for-anyone-who-was-ever.pdfIn PDF document text
    • http://www.gorillawalker.com/the-march-on-washington-uniting-against-racism-snapshots-in-history.pdfIn PDF document text
    • http://www.gorillawalker.com/case-studies-in-project-program-and-organizational-project-management.pdfIn PDF document text
    • http://www.gorillawalker.com/eden-plum-large-bible-cover.pdfIn PDF document text
    • http://www.gorillawalker.com/random-geometric-graphs-oxford-studies-in-probability.pdfIn PDF document text
    • http://www.gorillawalker.com/primer-libro-de-jos-ord-ez-a-los-aburridos-una.pdfIn PDF document text
    • http://www.gorillawalker.com/going-interstellar.pdfIn PDF document text
    • http://www.gorillawalker.com/the-keys-to-the-white-house-a-surefire-guide-to.pdfIn PDF document text
    • http://www.gorillawalker.com/31-days-of-the-paschal-mystery-of-jesus.pdfIn PDF document text
    • http://www.gorillawalker.com/first-lady-of-the-senate-a-life-of-margaret-chase.pdfIn PDF document text
    • http://www.gorillawalker.com/origines-perspectives-chr-tiennes-sur-la-cr-ation-l-volution.pdfIn PDF document text
    • http://www.gorillawalker.com/voila-2-higher-teacher-s-book.pdfIn PDF document text
    • http://www.gorillawalker.com/global-information-systems-and-technology-focus-on-the-organization-and.pdfIn PDF document text
    • http://www.gorillawalker.com/travels-in-european-turkey-through-bosnia-servia-bulgaria-macedonia-thrace.pdfIn PDF document text
    • http://www.gorillawalker.com/why-nations-fail-the-origins-of-power-prosperity-and-poverty.pdfIn PDF document text
    • http://www.gorillawalker.com/gloria-for-solo-voices-mixed-chorus-and-orchestra-vocal-score.pdfIn PDF document text
    • http://www.gorillawalker.com/british-hoverflies-an-illustrated-identification-guide.pdfIn PDF document text
    • http://www.gorillawalker.com/zambia-travel-guide-zambia-in-the-sun.pdfIn PDF document text
    • http://www.gorillawalker.com/hydrazine-and-its-derivatives-preparation-properties-applications-2-volume-set.pdfIn PDF document text
    • http://www.gorillawalker.com/roughing-the-passer-seattle-lumberjacks-book-6-kindle-edition.pdfIn PDF document text
    • http://www.gorillawalker.com/steck-vaughn-bilingual-reading-comprehension-reproducible-grade-2.pdfIn PDF document text
    • http://www.gorillawalker.com/political-theologies-in-shakespeare-s-england-the-sacred-and-the.pdfIn PDF document text
    • http://www.gorillawalker.com/black-female-playwrights-an-anthology-of-plays-before-1950-blacks.pdfIn PDF document text
    • http://www.gorillawalker.com/howard-morgen-s-solo-guitar-insights-arranging-techniques-classic-jazz.pdfIn PDF document text
    • http://www.gorillawalker.com/social-work-advocacy-a-new-framework-for-action.pdfIn PDF document text
    • http://www.gorillawalker.com/the-key-to-the-treasury-of-shunyata-dependent-arising-and.pdfIn PDF document text
    • http://www.gorillawalker.com/john-calvin-his-life-and-influence.pdfIn PDF document text
    • http://www.gorillawalker.com/gui-graphical-user-interface-design.pdfIn PDF document text
    • http://www.gorillawalker.com/the-epistle-to-the-hebrews-new-international-commentary-on-the.pdfIn PDF document text
    • http://www.gorillawalker.com/the-textbook-of-the-universe-the-genetic-ascent-to-god.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.