Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6aa12c95c0758c0…

MALICIOUS

PDF

46.6 KB Created: 2018-11-26 20:07:13 +03:00 Authoring application: TeXmacs-1.0.7.3 (via GPL Ghostscript 8.70)
MD5: bbd285f87aa2c2cccd9edcf3163e588e SHA-1: e016d860a81ae1349448b42ee9aec5ccc0c84874 SHA-256: c6aa12c95c0758c0260aef718702c7e69f0e631a28b29ada81c4d27e3006d65f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains a large number of external links, indicating a link farm. The primary heuristic identified a "PDF_SEO_LINK_FARM" with 32 external PDF links, the first of which is http://www.gorillawalker.com/art-brands-when-dogs-eat-beuys.pdf. This suggests the document's purpose is to redirect users to a large collection of other documents, likely for SEO manipulation or to host malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8013

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/art-brands-when-dogs-eat-beuys.pdf
    • http://www.gorillawalker.com/a-student-s-dream-twisted-cogs-book-1.pdf
    • http://www.gorillawalker.com/housing-allocation-and-homelessness-law-and-practice-second-edition.pdf
    • http://www.gorillawalker.com/historia-del-descubrimiento-y-conquista-del-peru-coleccion-clasicos-peruanos.pdf
    • http://www.gorillawalker.com/home-heaven-and-hitler-s-hell.pdf
    • http://www.gorillawalker.com/list-of-some-briefs-in-appeal-causes-which-relate-to.pdf
    • http://www.gorillawalker.com/food-for-the-fed-up-i-believe-sermons-on-the.pdf
    • http://www.gorillawalker.com/cumpliendo-tu-promesa-espiritual-spanish-edition.pdf
    • http://www.gorillawalker.com/behavior-analysis-for-lasting-change.pdf
    • http://www.gorillawalker.com/conversations-with-screenwriters.pdf
    • http://www.gorillawalker.com/reliability-assessment-using-stochastic-finite-element-analysis.pdf
    • http://www.gorillawalker.com/sevcik-otakar-school-of-bowing-technics-op-2-book-5.pdf
    • http://www.gorillawalker.com/the-triumph-tragedy-of-lyndon-johnson-the-white-house-years.pdf
    • http://www.gorillawalker.com/washing-your-life-away-a-true-story-based-on-the.pdf
    • http://www.gorillawalker.com/secrets-of-the-ebay-millionaires-inside-success-stories-and-proven.pdf
    • http://www.gorillawalker.com/pre-calculus-and-sat-lecture-notes-vol-1-pre-calculus.pdf
    • http://www.gorillawalker.com/chicken-soup-for-the-golfer-s-soul-101-stories-of.pdf
    • http://www.gorillawalker.com/conchtown-usa-bahamian-fisherfolk-in-riviera-beach-florida.pdf
    • http://www.gorillawalker.com/the-weight-of-things-philosophy-and-the-good-life.pdf
    • http://www.gorillawalker.com/easy-endgame-strategies.pdf
    • http://www.gorillawalker.com/men-s-health-the-body-you-want-in-the-time.pdf
    • http://www.gorillawalker.com/encyclopedia-of-virology-2nd-edition-3-volume-set.pdf
    • http://www.gorillawalker.com/anthropology-a-global-perspective-7th-edition.pdf
    • http://www.gorillawalker.com/skillz-ii-kindle-edition.pdf
    • http://www.gorillawalker.com/the-beautiful-days-of-my-youth-my-six-months-in.pdf
    • http://www.gorillawalker.com/building-electro-optical-systems-making-it-all-work.pdf
    • http://www.gorillawalker.com/create-your-own-pension-a-practical-game-plan-for-income.pdf
    • http://www.gorillawalker.com/severed-the-true-story-of-the-black-dahlia-murder.pdf
    • http://www.gorillawalker.com/materials-structures-and-standards-all-details-architects-need-to-know.pdf
    • http://www.gorillawalker.com/bulletin-of-the-seismological-society-of-america-1973-bulletin-63.pdf
    • http://www.gorillawalker.com/a-hand-book-for-travellers-on-the-continent-being-a.pdf
    • http://www.gorillawalker.com/guatemala-past-and-present.pdf
    • http://www.gorillawalker.com/asbestos-blues-labour-capital-physicians-and-the-state-in-south.pdf
    • http://www.gorillawalker.com/harry-potter-places-book-four-newts-northeastern-england-wizarding-treks.pdf
    • http://www.gorillawalker.com/acoustic-phonetics-current-studies-in-linguistics.pdf
    • http://www.gorillawalker.com/releasing-the-spirit.pdf
    • http://www.gorillawalker.com/engineering-hydrology-4e.pdf
    • http://www.gorillawalker.com/american-stories-a-history-of-the-united-states-volume-2.pdf
    • http://www.gorillawalker.com/the-revenge-of-the-wizard-s-ghost-johnny-dixon.pdf
    • http://www.gorillawalker.com/violin-exam-pieces-g-5-score-part-cd-abrsm-exam.pdf
    • http://www.gorillawalker.com/list-of-some-briefs-in-appeal-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.