Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc03f1fa620ad9d0…

MALICIOUS

PDF

43.3 KB Created: 2018-11-14 08:16:21 +03:00 Authoring application: Adobe InDesign CC 2015 (Macintosh) (via Adobe PDF Library 15.0)
MD5: 278df9e04909ba0459ac4a509869d6e1 SHA-1: 3bc715bcec003cc7cd60234381580d31ec50c005 SHA-256: dc03f1fa620ad9d03903b1e555bb60e01d33a016b8bd330c9e1850c40a5019c9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links pointing to external PDF files, predominantly hosted on 'www.gorillawalker.com'. This behavior is indicative of a link farm or SEO manipulation tactic. The ML classifier also flagged the PDF as malicious. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/principles-of-neuropsychopharmacology.pdf
    • http://www.gorillawalker.com/historia-general-del-peru-segunda-parte-de-los-comentarios-reales.pdf
    • http://www.gorillawalker.com/official-guide-book-of-the-panama-california-exposition-giving-in.pdf
    • http://www.gorillawalker.com/the-male-totem-in-klepht-poetry-parallels-with-the-iliad.pdf
    • http://www.gorillawalker.com/travel-and-politics-in-armenia-by-noel-buxton-m-p.pdf
    • http://www.gorillawalker.com/the-world-s-greatest-wine-estates-a-modern-perspective.pdf
    • http://www.gorillawalker.com/star-wars-ground-assault-game-pack.pdf
    • http://www.gorillawalker.com/the-face-in-the-mirror.pdf
    • http://www.gorillawalker.com/it-s-a-secret-so-pass-it-on-a-toolbox.pdf
    • http://www.gorillawalker.com/to-find-cora-like-mink-like-murder-body-and-passion.pdf
    • http://www.gorillawalker.com/a-public-relations-bibliography.pdf
    • http://www.gorillawalker.com/orthodontics-principles-and-practice.pdf
    • http://www.gorillawalker.com/lectures-on-classical-differential-geometry.pdf
    • http://www.gorillawalker.com/the-baking-bible.pdf
    • http://www.gorillawalker.com/david-busch-s-olympus-e-5-guide-to-digital-slr.pdf
    • http://www.gorillawalker.com/classic-still-life-painting-a-contemporary-master-shows-how-to.pdf
    • http://www.gorillawalker.com/buddha-doodles-gratitude-journal-shining-your-light.pdf
    • http://www.gorillawalker.com/do-or-die-a-new-paranormal-romance-series-for-adults.pdf
    • http://www.gorillawalker.com/ethnic-music-on-records-a-discography-of-ethnic-recordings-produced.pdf
    • http://www.gorillawalker.com/library-research-guide-to-religion-and-theology-illustrated-search-strategy.pdf
    • http://www.gorillawalker.com/chez-panisse-menu-cookbook.pdf
    • http://www.gorillawalker.com/religions-of-china-in-practice.pdf
    • http://www.gorillawalker.com/la-macchinazione-pasolini-la-verit-sulla-morte-saggi-italiani-italian.pdf
    • http://www.gorillawalker.com/brin-samuel-v-u-s-u-s-supreme-court-transcript.pdf
    • http://www.gorillawalker.com/the-federalist-papers-enriched-classics.pdf
    • http://www.gorillawalker.com/the-official-book-of-the-rugby-world-cup-1991.pdf
    • http://www.gorillawalker.com/a-love-like-this-2-the-finale.pdf
    • http://www.gorillawalker.com/radical-islam-world-of-islam.pdf
    • http://www.gorillawalker.com/what-s-that-sound-science-solves-it.pdf
    • http://www.gorillawalker.com/natural-histories-journal-crab.pdf
    • http://www.gorillawalker.com/it-s-ok-tom-and-ally-visit-the-doctor-it.pdf
    • http://www.gorillawalker.com/advanced-microsystems-for-automotive-applications-98-vdi-buch.pdf
    • http://www.gorillawalker.com/global-health-101-essential-public-health.pdf
    • http://www.gorillawalker.com/mapep-primary-english-uganda-tb2.pdf
    • http://www.gorillawalker.com/why-emu-cant-fly-bawoo-stories.pdf
    • http://www.gorillawalker.com/observations-from-an-obesity-overcomer-take-the-scenic-route.pdf
    • http://www.gorillawalker.com/the-lamberts-george-constant-and-kit.pdf
    • http://www.gorillawalker.com/first-time-with-a-shifter-luna-werewolves-11-siren-publishing.pdf
    • http://www.gorillawalker.com/the-sweetest-summer-a-novel-bayberry-island.pdf
    • http://www.gorillawalker.com/aqa-as-business-studies-student-unit-guide-planning-and-financing.pdf
    • http://www.gorillawalker.com/the-world-s-great
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.