Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7ce680a2d202efc…

MALICIOUS

PDF

34.1 KB Created: 2019-09-02 21:58:57 +03:00 Authoring application: TeX (via dvipdfmx)
MD5: 25664d3cd5522a374b5e1ad3a57ed0b5 SHA-1: 0070f2fb73276a72c283e4ba41dcbed2651478cd SHA-256: d7ce680a2d202efc28c699bdaa42879fd1a0451e4b5c090f0acbd27d6ad0fcf4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a critical heuristic for containing a mass external link farm, with 32 links pointing to PDFs on the dominant host 'www.gorillawalker.com'. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the structure and numerous embedded URLs suggest a deceptive intent, likely to lure users to potentially malicious content or for SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8015

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/chess-tactics-batsford-chess.pdf
    • http://www.gorillawalker.com/horrible-science-space-stars-and-slimy-aliens.pdf
    • http://www.gorillawalker.com/lost-crafts.pdf
    • http://www.gorillawalker.com/cq-researcher-on-controversies-in-law-and-society.pdf
    • http://www.gorillawalker.com/the-bantu-jareer-somalis-the-bantu-jareer-somalis-unearthing-apartheid.pdf
    • http://www.gorillawalker.com/revolutionary-heart-the-life-of-clarina-nichols-and-the-pioneering.pdf
    • http://www.gorillawalker.com/introduction-to-symmetry-and-group-theory-for-chemists.pdf
    • http://www.gorillawalker.com/activities-and-approaches-for-alzheimers-paperback.pdf
    • http://www.gorillawalker.com/the-a-word-library-edition-sweet-dead-life.pdf
    • http://www.gorillawalker.com/when-grace-sings.pdf
    • http://www.gorillawalker.com/richard-sherman-football-stars-up-close.pdf
    • http://www.gorillawalker.com/personal-protective-equipment-for-chemical-biological-and-radiological-hazards-design.pdf
    • http://www.gorillawalker.com/stormwater-best-management-practices-and-detention-for-water-quality-drainage.pdf
    • http://www.gorillawalker.com/techone-automotive-engine-performance.pdf
    • http://www.gorillawalker.com/laughing-at-the-dao.pdf
    • http://www.gorillawalker.com/suicide-s-girlfriend-digital.pdf
    • http://www.gorillawalker.com/special-days-with-brady-and-casey.pdf
    • http://www.gorillawalker.com/knowledge-governance-processes-and-perspectives.pdf
    • http://www.gorillawalker.com/decision-analysis-for-management-judgment.pdf
    • http://www.gorillawalker.com/personality-individual-differences-and-intelligence.pdf
    • http://www.gorillawalker.com/dk-guide-to-public-speaking-plus-new-mycommunicationlab-with-pearson.pdf
    • http://www.gorillawalker.com/pathfinder-campaign-setting-occult-realms.pdf
    • http://www.gorillawalker.com/kid-s-box-3-activity-book.pdf
    • http://www.gorillawalker.com/guide-to-cytochromes-p450-structure-and-function-second-edition.pdf
    • http://www.gorillawalker.com/principles-of-accounts-for-the-caribbean.pdf
    • http://www.gorillawalker.com/essential-science-for-cambridge-secondary-1-stage-7-workbook.pdf
    • http://www.gorillawalker.com/container-gardening-for-beginners-the-ultimate-guide-to-raised-bed.pdf
    • http://www.gorillawalker.com/goin-crazy-with-sam-peckinpah-and-all-our-friends.pdf
    • http://www.gorillawalker.com/baudelaire-s-prose-poems-the-esthetic-the-ethical-and-the.pdf
    • http://www.gorillawalker.com/arctic-explorations-and-discoveries-during-the-nineteeth-century-being-detailed.pdf
    • http://www.gorillawalker.com/designing-web-server-with-j2ee-14-platform-04-by-singh.pdf
    • http://www.gorillawalker.com/the-gospel-according-to-dr-seuss-leader-s-guide.pdf
    • http://www.gorillawalker.com/momentum-trading-a-simple-day-trading-strategy-for-consistent-profits.pdf
    • http://www.gorillawalker.com/nicaragua-unfinished-revolution-the-new-nicaragua-reader.pdf
    • http://www.gorillawalker.com/evolutionary-multi-criterion-optimization-first-international-conference-emo-2001-zurich.pdf
    • http://www.gorillawalker.com/the-anatomy-of-courage.pdf
    • http://www.gorillawalker.com/doing-business-with-georgia-global-market-briefings-series.pdf
    • http://www.gorillawalker.com/in-the-midst-of-tribulation.pdf
    • http://www.gorillawalker.com/enid-blyton-adventure-treasury.pdf
    • http://www.gorillawalker.com/uppers-downers-all-arounders-physical-and-mental-effects-of-psychoactive.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.