Malicious PDF — malware analysis report

Static analysis result for SHA-256 cebd1ee29058d5ff…

MALICIOUS

PDF

39.8 KB Created: 2018-12-15 20:09:52 +03:00 Authoring application: TeX (via pdfTeX-1.40.17)
MD5: c3e1fce09e63abd225cf2bd70757262e SHA-1: 6efd09c424affcc738e82f8df48bd34cdce0cac6 SHA-256: cebd1ee29058d5ff2fada2f094d4920185d339c0bb117189c6afcd24cb9c4b27
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain www.gorillawalker.com. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious payloads. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/fokine-memoirs-of-a-ballet-master.pdf
    • http://www.gorillawalker.com/morals-and-dogma-of-the-ancient-and-accepted-scottish-rite.pdf
    • http://www.gorillawalker.com/pageant-the-beauty-contest.pdf
    • http://www.gorillawalker.com/industrial-and-hazardous-waste-treatment-environmental-engineering-series.pdf
    • http://www.gorillawalker.com/audience-marketing-in-the-age-of-subscribers-fans-and-followers.pdf
    • http://www.gorillawalker.com/gym-boys-gay-erotic-stories.pdf
    • http://www.gorillawalker.com/jetzt-leben-mit-krebs-leidfaden-2015-heft-02-german-edition.pdf
    • http://www.gorillawalker.com/practically-raw-desserts-flexible-recipes-for-all-natural-sweets-and.pdf
    • http://www.gorillawalker.com/abelian-functions-abel-s-theorem-and-the-allied-theory-of.pdf
    • http://www.gorillawalker.com/understanding-imperial-russia.pdf
    • http://www.gorillawalker.com/dino-might-go-diego-go-color-plus-tattoos.pdf
    • http://www.gorillawalker.com/emerald-go-reader-audiobooks.pdf
    • http://www.gorillawalker.com/saunders-2008-icd-9-cm-volumes-1-2-and-3.pdf
    • http://www.gorillawalker.com/coaching-positively-lessons-for-coaches-from-positive-psychology-coaching-in.pdf
    • http://www.gorillawalker.com/maine-black-bears-2012-calendar.pdf
    • http://www.gorillawalker.com/delta-force-the-army-s-elite-counterterrorist-unit.pdf
    • http://www.gorillawalker.com/the-magic-engineer-a-novel-in-the-saga-of-recluce.pdf
    • http://www.gorillawalker.com/electrify-my-soul-songwriters-and-the-spiritual-source-author-dan.pdf
    • http://www.gorillawalker.com/carving-golfers-12-projects-capturing-the-joys-and-frustrations-of.pdf
    • http://www.gorillawalker.com/come-to-the-feast-companion-to-holy-communion.pdf
    • http://www.gorillawalker.com/nfpa-70e-standard-for-electrical-safety-in-the-workplace-2004.pdf
    • http://www.gorillawalker.com/iarc-biennial-report-2008-2009-iarc-scientific-publication.pdf
    • http://www.gorillawalker.com/touchthinklearn-baby-animals.pdf
    • http://www.gorillawalker.com/compound-interest-tables.pdf
    • http://www.gorillawalker.com/biomedical-index-to-phs-supported-research-volume-2.pdf
    • http://www.gorillawalker.com/law-101-everything-you-need-to-know-about-american-law.pdf
    • http://www.gorillawalker.com/cultural-traditions-in-brazil-cultural-traditions-in-my-world.pdf
    • http://www.gorillawalker.com/a-guide-to-corporate-governance.pdf
    • http://www.gorillawalker.com/the-new-wave-mai-tai.pdf
    • http://www.gorillawalker.com/java-practice-questions-oracle-certified-associate-java-se-7-programmer.pdf
    • http://www.gorillawalker.com/last-trout-in-venice-the-far-flung-escapades-of-an.pdf
    • http://www.gorillawalker.com/the-earth-problems-and-perspectives.pdf
    • http://www.gorillawalker.com/ogre-ogre.pdf
    • http://www.gorillawalker.com/new-guinea-impressions-in-the-footsteps-of-myklukho-maklay.pdf
    • http://www.gorillawalker.com/artificial-limbs-innovation-in-medicine-21st-century-skills.pdf
    • http://www.gorillawalker.com/taking-what-s-mine-forced-submission-book-1.pdf
    • http://www.gorillawalker.com/tales-of-majipoor-majipoor-cycle-series.pdf
    • http://www.gorillawalker.com/the-mysterious-death-of-mary-rogers-sex-and-culture-in.pdf
    • http://www.gorillawalker.com/elastohydrodynamics.pdf
    • http://www.gorillawalker.com/the-kids-book-of-weather-forecasting-kids-can.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.