Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3267cc86a6abe8c…

MALICIOUS

PDF

45.8 KB Created: 2018-11-26 20:06:59 +03:00 Authoring application: QuarkXPress(R) 9.0
MD5: 89990adef347e2f31f6d2ee0aef392a0 SHA-1: 7fb82ee53cba71815ec3f0adf71fe669b5ef7a07 SHA-256: d3267cc86a6abe8cfd764d550d07510780d477f97e26903174fb37b8f61d91d1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body is heavily obfuscated and does not provide clear textual lures. The primary attack pattern appears to be a link farm designed to manipulate search engine results or direct users to a large collection of documents hosted on www.gorillawalker.com.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/organizational-ecology.pdf
    • http://www.gorillawalker.com/rhinosinusitis-a-guide-for-diagnosis-and-management.pdf
    • http://www.gorillawalker.com/morphologie-un-blog-transformado-en-libro-sobre-periodismo-cultura-viajes.pdf
    • http://www.gorillawalker.com/curating-vienna-city-notebook-for-vienna-austria-a-d-i.pdf
    • http://www.gorillawalker.com/nixon-off-the-record-his-candid-commentary-on-people-and.pdf
    • http://www.gorillawalker.com/the-nevada-corporation-handbook.pdf
    • http://www.gorillawalker.com/m-s-dinero-para-su-causa-como-obtener-fondos-de.pdf
    • http://www.gorillawalker.com/when-grace-comes-home-how-the-doctrines-of-grace-change.pdf
    • http://www.gorillawalker.com/cengage-advantage-books-visual-storytelling-videography-and-post-production-in.pdf
    • http://www.gorillawalker.com/medical-terminology-systems-a-body-systems-approach.pdf
    • http://www.gorillawalker.com/heaven-to-eden.pdf
    • http://www.gorillawalker.com/perspectives-of-nonlinear-dynamics-volume-2.pdf
    • http://www.gorillawalker.com/jon.pdf
    • http://www.gorillawalker.com/aqa-a2-business-studies-student-unit-guide-strategies-for-success.pdf
    • http://www.gorillawalker.com/native-american-poetry.pdf
    • http://www.gorillawalker.com/the-original-peter-rabbit-slimline-calendar-1999.pdf
    • http://www.gorillawalker.com/civil-procedure.pdf
    • http://www.gorillawalker.com/queen-esther-saves-her-people.pdf
    • http://www.gorillawalker.com/must-eat-london-an-eclectic-selection-of-culinary-locations.pdf
    • http://www.gorillawalker.com/schottenstein-edition-talmud-yerushalmi-tractate-kilayim.pdf
    • http://www.gorillawalker.com/the-sounds-of-my-jewish-year-very-first-board-books.pdf
    • http://www.gorillawalker.com/thermal-and-power-management-of-integrated-circuits-integrated-circuits-and.pdf
    • http://www.gorillawalker.com/list-of-available-forestry-publications-from-louisiana-state-university-lsu.pdf
    • http://www.gorillawalker.com/cliffsnotes-on-conrad-s-heart-of-darkness-the-secret-sharer.pdf
    • http://www.gorillawalker.com/the-yellow-canary.pdf
    • http://www.gorillawalker.com/the-anchor-us-naval-training-center-san-diego-company-1962.pdf
    • http://www.gorillawalker.com/flash-building-the-interactive-web-platform-studies.pdf
    • http://www.gorillawalker.com/reference-guide-for-essential-oils-soft-cover-2014-spiral-bound.pdf
    • http://www.gorillawalker.com/pennsylvania-railroad-diesel-locomotive-pictorial-vol-4-baldwin-cab-and.pdf
    • http://www.gorillawalker.com/staar-success-strategies-grade-3-mathematics-study-guide-staar-test.pdf
    • http://www.gorillawalker.com/linear-and-nonlinear-optimization-second-edition.pdf
    • http://www.gorillawalker.com/chase-chance-and-creativity-the-lucky-art-of-novelty.pdf
    • http://www.gorillawalker.com/from-gods-we-steal-tales-of-the-barbarian.pdf
    • http://www.gorillawalker.com/the-giovanna-ferrari-repair-it-all-mystery-series-books-1.pdf
    • http://www.gorillawalker.com/by-lonely-planet-lonely-planet-discover-peru-travel-guide-2nd.pdf
    • http://www.gorillawalker.com/secret-heresy-of-hieronymus-bosch.pdf
    • http://www.gorillawalker.com/miss-manners-guide-for-the-turn-of-the-millenium.pdf
    • http://www.gorillawalker.com/off-track-planet-146-s-travel-guide-for-the-young.pdf
    • http://www.gorillawalker.com/the-chickasaw-rancher-revised-edition.pdf
    • http://www.gorillawalker.com/a-year-s-residence-in-the-united-states-of-america.pdf
    • http://www.gorillawalker.com/curating-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.