Malicious PDF — malware analysis report

Static analysis result for SHA-256 df8af3f7aa99e9e4…

MALICIOUS

PDF

33.2 KB Created: 2019-09-19 15:09:42 +03:00 Authoring application: Word (via Mac OS X 10.7.5 Quartz PDFContext)
MD5: 79b69d7892c9ecfbaf227423317669c7 SHA-1: 21785a1f95ed8a79834b60067a801ad278e6c35b SHA-256: df8af3f7aa99e9e40797ca0ac2d08c8fa2bff3a73982ca987a4d5920f335d072
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, likely intended for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/macabre-a-journey-through-australia-s-darkest-fears.pdf
    • http://www.gorillawalker.com/fooling-some-of-the-people-all-of-the-time-a.pdf
    • http://www.gorillawalker.com/changing-fortunes-income-mobility-and-poverty-dynamics-in-britain.pdf
    • http://www.gorillawalker.com/possessive-love-yaoi.pdf
    • http://www.gorillawalker.com/design-and-technology-stage-6-digital-toolkit.pdf
    • http://www.gorillawalker.com/las-mil-noches-y-una-noche-spanish-edition-paperback.pdf
    • http://www.gorillawalker.com/introduction-to-harmonica.pdf
    • http://www.gorillawalker.com/classic-rice-and-noodles-cookbook-quick-and-easy-recipes-kindle.pdf
    • http://www.gorillawalker.com/ultrafast-hydrogen-bonding-dynamics-and-proton-transfer-processes-in-the.pdf
    • http://www.gorillawalker.com/age-gets-better-with-wine-new-science-for-a-healthier.pdf
    • http://www.gorillawalker.com/pizza-50-traditional-and-alternative-recipes-for-the-oven-and.pdf
    • http://www.gorillawalker.com/superman-sticker-book.pdf
    • http://www.gorillawalker.com/update-on-neonatal-respiratory-disorders-and-surfactant-proceedings-of-the.pdf
    • http://www.gorillawalker.com/resisting-rebellion-the-history-and-politics-of-counterinsurgency.pdf
    • http://www.gorillawalker.com/internet-made-easy-internet-scavenger-hunts-for-the-topics-you.pdf
    • http://www.gorillawalker.com/contrarian-investor-13-how-to-earn-superior-returns-in-the.pdf
    • http://www.gorillawalker.com/shanghai-you-can-get-all-attractions-through-subway-kindle-edition.pdf
    • http://www.gorillawalker.com/american-assassin-a-thriller-the-mitch-rapp-series-book-1.pdf
    • http://www.gorillawalker.com/tomorrow-shall-be-my-dancing-day-vocal-score.pdf
    • http://www.gorillawalker.com/il-ribelle-con-le-ali-la-storia-di-icaro-italian.pdf
    • http://www.gorillawalker.com/compass-in-the-blood.pdf
    • http://www.gorillawalker.com/sex-lies-and-the-ford-motor-company-assembly-line.pdf
    • http://www.gorillawalker.com/stochastic-spatial-processes-mathematical-theories-and-biological-applications-lecture-notes.pdf
    • http://www.gorillawalker.com/the-jaguar-endangered-animals-and-habitats.pdf
    • http://www.gorillawalker.com/the-life-of-patriarch-ignatius-dumbarton-oaks-texts.pdf
    • http://www.gorillawalker.com/blutjung-roman-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/nombradas-named-tambien-en-el-ambito-juridico-also-in-the.pdf
    • http://www.gorillawalker.com/a-wind-tunnel-investigation-of-jets-exhausting-into-crossflow-technical.pdf
    • http://www.gorillawalker.com/on-organizational-learning-paperback-1999-author-chris-argyris.pdf
    • http://www.gorillawalker.com/georges-store-at-the-shore.pdf
    • http://www.gorillawalker.com/dim-sum-book.pdf
    • http://www.gorillawalker.com/running-lean-iterate-from-plan-a-to-a-plan-that.pdf
    • http://www.gorillawalker.com/the-meaning-of-life-2-more-lives-more-meaning.pdf
    • http://www.gorillawalker.com/politico-economic-writings-an-annotated-reprint-of-zeitungsartikel-und-vortr.pdf
    • http://www.gorillawalker.com/build-your-own-redwall-abbey-kit.pdf
    • http://www.gorillawalker.com/pathfinder-adventure-card-game-skull-shackles-adventure-deck-5-the.pdf
    • http://www.gorillawalker.com/caribbean-the-2015-square-12x12.pdf
    • http://www.gorillawalker.com/exercises-in-helping-skills-for-egan-s-the-skilled-helper.pdf
    • http://www.gorillawalker.com/saving-our-cities-you-can-change-your-city-for-god.pdf
    • http://www.gorillawalker.com/strength-for-today-bright-hope-for-tomorrow-god-s-comfort.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.