Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6b458ea6cebf294…

MALICIOUS

PDF

42.1 KB Created: 2018-12-14 20:12:36 +03:00 Authoring application: Microsoft Word 8.0 (via Acrobat Distiller 4.0 for Windows)
MD5: 18dcefc8e3016da6c93b5e400138466e SHA-1: 259e0abd90a8d81ed97c0bb669ab7d660481728f SHA-256: d6b458ea6cebf29457568d9303ef1b9978c134876298b32bee8586b5d388947c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF documents on the domain www.gorillawalker.com. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. The document body appears to be malformed or heavily obfuscated, preventing a clear understanding of its direct user-facing content, but the link farm strongly suggests a malicious intent, possibly for SEO manipulation or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/abc-s-of-debt-a-case-study-approach-to-debtor.pdf
    • http://www.gorillawalker.com/harpers-illustrated-biochemistry-29th-edition-lange-basic-science-by-murray.pdf
    • http://www.gorillawalker.com/trading-binary-options-strategies-and-tactics.pdf
    • http://www.gorillawalker.com/problems-of-modern-philology-pedagogics-and-psychology-materials-digest-of.pdf
    • http://www.gorillawalker.com/farmyard-counting-book-board-register-books.pdf
    • http://www.gorillawalker.com/summer-bridge-explorations-grades-3-4.pdf
    • http://www.gorillawalker.com/superior-order-curvature-correction-techniques-for-voltage-references.pdf
    • http://www.gorillawalker.com/my-wicked-wicked-ways-the-autobiography-of-errol-flynn.pdf
    • http://www.gorillawalker.com/reinventing-peacekeeping-in-africa-conceptual-and-legal-issues-in-ecomog.pdf
    • http://www.gorillawalker.com/bouncing-off-guardrails-somewhere-in-life-between-victorious-triumph-and.pdf
    • http://www.gorillawalker.com/how-to-kill-your-husband-heartfelt-recipes.pdf
    • http://www.gorillawalker.com/building-financial-derivatives-applications-with-c.pdf
    • http://www.gorillawalker.com/a-case-for-excellence.pdf
    • http://www.gorillawalker.com/century-farm.pdf
    • http://www.gorillawalker.com/the-amazing-body-book.pdf
    • http://www.gorillawalker.com/rick-steves-switzerland-kindle-edition.pdf
    • http://www.gorillawalker.com/becoming-a-chef.pdf
    • http://www.gorillawalker.com/what-you-can-do-about-allergies-contemporary-diseases-and-disorders.pdf
    • http://www.gorillawalker.com/sapper-martin.pdf
    • http://www.gorillawalker.com/kiss-of-the-spider-woman.pdf
    • http://www.gorillawalker.com/hamburgers-just-amazing-recipes-kindle-edition.pdf
    • http://www.gorillawalker.com/tree-seasons-come-seasons-go.pdf
    • http://www.gorillawalker.com/in-the-footsteps-of-the-quiet-man-the-inside-story.pdf
    • http://www.gorillawalker.com/the-not-so-wise-man.pdf
    • http://www.gorillawalker.com/milanese-encounters-public-space-and-vision-in-contemporary-urban-italy.pdf
    • http://www.gorillawalker.com/bridge-to-terabithia-a-puffin-book.pdf
    • http://www.gorillawalker.com/chemical-engineering-applications-in-solid-waste-management.pdf
    • http://www.gorillawalker.com/51-by-john-lennon-and-paul-mccartney-easy-big-note.pdf
    • http://www.gorillawalker.com/the-shadow-of-the-swastika-the-rise-of-fascism-and.pdf
    • http://www.gorillawalker.com/wild-wicked-wanton.pdf
    • http://www.gorillawalker.com/carving-wood-and-stone-an-illustrated-guide-a-spectrum-book.pdf
    • http://www.gorillawalker.com/4-lieder-op-27-caecilie-no-2-for-voice-and.pdf
    • http://www.gorillawalker.com/time-jumpers-kindle-edition.pdf
    • http://www.gorillawalker.com/section-12.pdf
    • http://www.gorillawalker.com/r-b-guitar-play-along-volume-15.pdf
    • http://www.gorillawalker.com/galileo-s-revenge-junk-science-in-the-courtroom.pdf
    • http://www.gorillawalker.com/how-to-draw-with-colored-pencils-on-toned-paper-in.pdf
    • http://www.gorillawalker.com/class-and-stratification-an-introduction-to-current-debates.pdf
    • http://www.gorillawalker.com/yeshiva-girl-stories.pdf
    • http://www.gorillawalker.com/study-of-theology-the.pdf
    • http://www.gorillawalker.com/problems-of-modern-philology-pedagogics-and-psycho
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.