Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4f0053b02e62bb4…

MALICIOUS

PDF

42.8 KB Created: 2018-11-14 08:37:14 +03:00 Authoring application: Adobe InDesign CS5.5 (7.5) (via Adobe PDF Library 9.9)
MD5: 364089c6ceeda27710c052db938abd25 SHA-1: 281cbe0cb7b8d420e19bb8b893ff417f55fc9956 SHA-256: d4f0053b02e62bb46425d2812955d0e28dc0360d979310e7396141660e060e2d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious with high confidence. The embedded URLs point to various PDF documents hosted on www.gorillawalker.com, suggesting a link farm or content distribution strategy. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/service-providers-asps-isps-msps-nsps-and-wsps-a-wiley.pdf
    • http://www.gorillawalker.com/120-visions-of-heaven-and-hell-cd-rom-and-book.pdf
    • http://www.gorillawalker.com/earth-s-last-war-children-of-destiny-book-1-kindle.pdf
    • http://www.gorillawalker.com/critical-issues-for-student-affairs-challenges-and-opportunities.pdf
    • http://www.gorillawalker.com/ultimate-encyclopedia-of-snowboarding-all-action-guide.pdf
    • http://www.gorillawalker.com/dracula-in-the-dark-the-dracula-film-adaptations-contributions-to.pdf
    • http://www.gorillawalker.com/legend-of-the-giant-panda.pdf
    • http://www.gorillawalker.com/fodor-s-london-2016-full-color-travel-guide.pdf
    • http://www.gorillawalker.com/random-house-webster-s-student-notebook-dictionary.pdf
    • http://www.gorillawalker.com/appleby-farm-complete-story.pdf
    • http://www.gorillawalker.com/schaum-s-outline-of-basic-circuit-analysis-second-edition-schaum.pdf
    • http://www.gorillawalker.com/simians-cyborgs-and-women-the-reinvention-of-nature.pdf
    • http://www.gorillawalker.com/mayhawk-rising-the-pendragon-king-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/faking-reality-urban-books.pdf
    • http://www.gorillawalker.com/little-astronomer-journey-into-the-solar-system-from-the-sun.pdf
    • http://www.gorillawalker.com/proceedings-of-three-cie-workshops-on-criteria-for-road-lighting.pdf
    • http://www.gorillawalker.com/alexander-the-great-and-ancient-greece-rulers-and-their-times.pdf
    • http://www.gorillawalker.com/stretch-limousines-1928-2001-photo-archive.pdf
    • http://www.gorillawalker.com/envision-in-depth-reading-writing-and-researching-arguments-3rd-edition.pdf
    • http://www.gorillawalker.com/adult-photo-collecton-naked-in-black-erotic-images-nackt-adult.pdf
    • http://www.gorillawalker.com/weekends-at-bellevue-nine-years-on-the-night-shift-at.pdf
    • http://www.gorillawalker.com/the-history-of-literature-in-the-caribbean-series-30-offer.pdf
    • http://www.gorillawalker.com/introduction-to-microelectronic-devices-prentice-hall-series-in-solid-state.pdf
    • http://www.gorillawalker.com/schein-s-common-sense-emergency-abdominal-surgery-an-unconventional-book.pdf
    • http://www.gorillawalker.com/fossil.pdf
    • http://www.gorillawalker.com/interstellar-expeditions-report-ip3-battletech.pdf
    • http://www.gorillawalker.com/art-and-the-creative-unconscious-four-essays.pdf
    • http://www.gorillawalker.com/the-old-testament-our-call-to-faith-and-justice.pdf
    • http://www.gorillawalker.com/more-than-you-wanted-to-know-the-failure-of-mandated.pdf
    • http://www.gorillawalker.com/dk-eyewitness-books-music.pdf
    • http://www.gorillawalker.com/daily-readings-from-the-christian-in-complete-armour-daily-readings.pdf
    • http://www.gorillawalker.com/the-heavens-intimate-moments-with-your-majestic-god.pdf
    • http://www.gorillawalker.com/entropy-and-partial-differential-equations-research-notes-in-mathematics-series.pdf
    • http://www.gorillawalker.com/masteringgenetics-with-pearson-etext-standalone-access-card-for-concepts-of.pdf
    • http://www.gorillawalker.com/regueiras-coyote-blanco-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/biblioteca-esencial-101-libros-fundamentales-de-la-literatura-mundial-con.pdf
    • http://www.gorillawalker.com/photo-of-erotic-hot-vol-9-kindle-edition.pdf
    • http://www.gorillawalker.com/life-an-introduction-to-complex-systems-biology-understanding-complex-systems.pdf
    • http://www.gorillawalker.com/live-by-night-low-price-cd-joe-coughlin-series.pdf
    • http://www.gorillawalker.com/science-as-thinking-the-constants-and-variables-of-inquiry-teaching.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.