Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8d332f4fb5f4875…

MALICIOUS

PDF

32.5 KB Created: 2019-09-15 17:50:08 +03:00 Authoring application: Adobe InDesign CS4 (6.0) (via Adobe PDF Library 9.0)
MD5: 41ce9f5e109f4b8ad3c0c119d6839dba SHA-1: 6d66a4bb98d3cd16b7848f854d5648bc1b5b2eea SHA-256: c8d332f4fb5f48756551088ce04b124affb963f96eef89bfda4f6518a3ce2bcb
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents on the domain www.gorillawalker.com. This behavior is indicative of a link farm or SEO manipulation tactic. The primary heuristic firing, PDF_SEO_LINK_FARM, strongly suggests this malicious intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate payload.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/studies-in-indian-and-anglo-indian-fiction.pdf
    • http://www.gorillawalker.com/glycemic-index-cookbook-for-dummies.pdf
    • http://www.gorillawalker.com/i-m-neither-here-nor-there-mexicans-quotidian-struggles-with.pdf
    • http://www.gorillawalker.com/sepher-rezial-hemelach-the-book-of-the-angel-rezial.pdf
    • http://www.gorillawalker.com/vodou-songs-in-haitian-creole-and-english.pdf
    • http://www.gorillawalker.com/houses-by-the-sea-mexico.pdf
    • http://www.gorillawalker.com/children-s-rights-in-scotland.pdf
    • http://www.gorillawalker.com/encyclopedia-of-political-theory.pdf
    • http://www.gorillawalker.com/mike-wall-street-s-mayor-kindle-edition.pdf
    • http://www.gorillawalker.com/bitcoin-wealth-guide-learn-how-to-become-a-bitcoin-millionaire.pdf
    • http://www.gorillawalker.com/the-lowdown-in-high-town-an-r-r-johnson-novel.pdf
    • http://www.gorillawalker.com/the-official-norwich-city-annual-2011-2011-your-a-to.pdf
    • http://www.gorillawalker.com/incandescence.pdf
    • http://www.gorillawalker.com/beginner-s-guide-calligraphy-how-to-draw-paint-art-instruction.pdf
    • http://www.gorillawalker.com/david-busch-s-canon-eos-rebel-t1i-500d-guide-to.pdf
    • http://www.gorillawalker.com/port-out-starboard-home-and-other-language-myths.pdf
    • http://www.gorillawalker.com/sous-la-glace-chamonix-une-promenade-dans-une-grotte-de.pdf
    • http://www.gorillawalker.com/advanced-poker.pdf
    • http://www.gorillawalker.com/the-bucks-camp-log-1916-1928.pdf
    • http://www.gorillawalker.com/musculoskeletal-trauma-implications-for-sports-injury-management.pdf
    • http://www.gorillawalker.com/comedy-scenes-for-student-actors-short-sketches-for-young-performers.pdf
    • http://www.gorillawalker.com/las-diosas-de-cada-mujer-una-nueva-psicologia-femenina.pdf
    • http://www.gorillawalker.com/top-10-algarve-dk-eyewitness-top-10-travel-guide.pdf
    • http://www.gorillawalker.com/steve-cotter-the-complete-guide-to-kettlebell-lifting.pdf
    • http://www.gorillawalker.com/afrikan-matriarchal-foundations-the-igbo-case.pdf
    • http://www.gorillawalker.com/driving-scenic-new-zealand-a-guide-to-touring-new-zealand.pdf
    • http://www.gorillawalker.com/armored-cav-a-guided-tour-of-an-armored-cavalry-regiment.pdf
    • http://www.gorillawalker.com/a-theologico-political-treatise-and-a-political-treatise-dover-philosophical.pdf
    • http://www.gorillawalker.com/romance-tumble-into-love-a-diamond-creek-alaska-novel-contemporary.pdf
    • http://www.gorillawalker.com/blackjack-autumn-a-true-tale-of-life-death-and-splitting.pdf
    • http://www.gorillawalker.com/basic-solid-state-electronics-vol-2-audio-information-systems.pdf
    • http://www.gorillawalker.com/killer-whales.pdf
    • http://www.gorillawalker.com/moon-guatemala-moon-handbooks.pdf
    • http://www.gorillawalker.com/the-home-based-bookstore-start-your-own-business-selling-used.pdf
    • http://www.gorillawalker.com/seeing-the-self-heidegger-on-subjectivity-phaenomenologica.pdf
    • http://www.gorillawalker.com/making-ends-meet-making-sense-of-money-paperback.pdf
    • http://www.gorillawalker.com/analysis-of-the-behaviour-of-advanced-reactor-pressure-vessel-steels.pdf
    • http://www.gorillawalker.com/your-brain-at-work.pdf
    • http://www.gorillawalker.com/the-confederate-army-combat-uniforms-of-the-civil-war-vol.pdf
    • http://www.gorillawalker.com/poppy-s-secret-wish-ballerina-dreams-book-1.pdf
    • http://www.gorilla
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.