Malicious PDF — malware analysis report

Static analysis result for SHA-256 cafc0e301f27dc7a…

MALICIOUS

PDF

44.1 KB Created: 2018-12-15 20:11:16 +03:00 Authoring application: Acrobat Distiller 7.0.5 (Windows)
MD5: 221a1ac0bc6e24b97fd096a17d29436d SHA-1: 8fde64d4f8d3bf93384896f5b58de776b318deeb SHA-256: cafc0e301f27dc7addac677f1782a426777af9370fa7c0ccdc96b7b4228206b9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. The primary purpose appears to be to direct users to a vast collection of documents hosted on www.gorillawalker.com, potentially for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8824

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/clinical-chemistry-in-diagnosis-and-treatment.pdf
    • http://www.gorillawalker.com/dancing-the-dream-the-seven-sacred-paths-of-human-transformation.pdf
    • http://www.gorillawalker.com/theory-drill-games-set-2-early-elementary-level-john-thompson.pdf
    • http://www.gorillawalker.com/manual-de-neuroanestesia-y-neurocr-ticos-spanish-edition.pdf
    • http://www.gorillawalker.com/hunting-journal-1852-55-killie-campbell-africana-library-publications.pdf
    • http://www.gorillawalker.com/duo-for-flute-and-viola-op-10-playing-score-faber.pdf
    • http://www.gorillawalker.com/the-truth-about-muhammad-founder-of-the-world-s-most.pdf
    • http://www.gorillawalker.com/wisdom-of-the-masters.pdf
    • http://www.gorillawalker.com/introduction-to-the-history-of-the-islamic-states-of-northern.pdf
    • http://www.gorillawalker.com/pheasant-hunting.pdf
    • http://www.gorillawalker.com/boker-tov-good-morning-kar-ben-favorites.pdf
    • http://www.gorillawalker.com/retained-hypodermic-needles-in-the-neck-imaging-clinic-an-article.pdf
    • http://www.gorillawalker.com/how-to-have-great-legs-at-any-age.pdf
    • http://www.gorillawalker.com/the-restless-executive-reclaim-your-values-love-what-you-do.pdf
    • http://www.gorillawalker.com/republic-hackett-classics-kindle-edition.pdf
    • http://www.gorillawalker.com/little-owl-look-at-me-books.pdf
    • http://www.gorillawalker.com/hornblower-s-ships-their-history-their-models.pdf
    • http://www.gorillawalker.com/cowboys-and-cowgirls-yippeeyay.pdf
    • http://www.gorillawalker.com/having-the-world-in-view-essays-on-kant-hegel-and.pdf
    • http://www.gorillawalker.com/classic-chain-mail-jewelry-a-treasury-of-weaves.pdf
    • http://www.gorillawalker.com/dragon-in-exile-liaden-universe-book-18.pdf
    • http://www.gorillawalker.com/the-next-new-madrid-earthquake-a-survival-guide-for-the.pdf
    • http://www.gorillawalker.com/solos-for-the-tuba-player.pdf
    • http://www.gorillawalker.com/the-essence-of-materials-for-engineers.pdf
    • http://www.gorillawalker.com/managing-and-preventing-obesity-behavioural-factors-and-dietary-interventions-woodhead.pdf
    • http://www.gorillawalker.com/science-of-homoeopathy.pdf
    • http://www.gorillawalker.com/an-intervention.pdf
    • http://www.gorillawalker.com/pinball-machines-everything-you-wanted-to-know.pdf
    • http://www.gorillawalker.com/the-body-is-a-clear-place-and-other-statements-on.pdf
    • http://www.gorillawalker.com/women-s-identities-at-war-gender-motherhood-and-politics-in.pdf
    • http://www.gorillawalker.com/domesticando-tu-dinosaurio-spanish-edition.pdf
    • http://www.gorillawalker.com/the-history-of-the-hobbit-part-1-mr-baggins.pdf
    • http://www.gorillawalker.com/the-works-of-william-cullen-containing-his-physiology-nosology-and.pdf
    • http://www.gorillawalker.com/level-3-nvq-svq-diploma-brickwork-candidate-handbook-brickwork-nvq.pdf
    • http://www.gorillawalker.com/men-and-women-of-deep-piety.pdf
    • http://www.gorillawalker.com/cim-coursebook-01-02-marketing-fundamentals-cim-coursebook-s.pdf
    • http://www.gorillawalker.com/5-minutes-in-the-bath-buoyancy-power-to-hear-the.pdf
    • http://www.gorillawalker.com/a-voyage-to-the-south-sea-and-along-the-coasts.pdf
    • http://www.gorillawalker.com/consolatio-philosophiae-bryn-mawr-commentaries-latin.pdf
    • http://www.gorillawalker.com/rischi-e-opportunit.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.