Malicious PDF — malware analysis report

Static analysis result for SHA-256 e0e03c20b4bd3721…

MALICIOUS

PDF

43.3 KB Created: 2018-12-15 08:11:05 +03:00 Authoring application: Microsoft Word (via Mac OS X 10.6.8 Quartz PDFContext)
MD5: 0eee87fa247372e71b59f983471e1743 SHA-1: 9cbe8d2a302201573e9dee216f6c045396e5e9be SHA-256: e0e03c20b4bd372171f42ddcaaf58231ba73280d4f3011418a4e575a27874736
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file was flagged by an ML classifier as malicious and contains a large number of embedded links to external PDF files hosted on www.gorillawalker.com. This suggests a link farm or SEO poisoning attack. The embedded URLs are likely used to distribute further malicious content or to redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/pediatric-nursing-care-best-evidence-based-practices.pdf
    • http://www.gorillawalker.com/marketing-strategy-5th-edition.pdf
    • http://www.gorillawalker.com/gods-and-heroes-an-introduction-to-greek-mythology-yesterday-s.pdf
    • http://www.gorillawalker.com/nutrition-in-preventive-dentistry-science-and-practice.pdf
    • http://www.gorillawalker.com/kingdom-authority-warfare-2-learning-the-weapons-of-our-warfare.pdf
    • http://www.gorillawalker.com/the-baseball-coaching-manual-little-league-to-high-school-edition.pdf
    • http://www.gorillawalker.com/chincoteague-ponies-untold-tails-paperback.pdf
    • http://www.gorillawalker.com/zecca-the-mint-of-venice-in-the-middle-ages-published.pdf
    • http://www.gorillawalker.com/dominators-cynics-and-wallflowers-practical-strategies-for-moderating-meaningful-focus.pdf
    • http://www.gorillawalker.com/party-for-two-ways-to-add-love-and-laughter-to.pdf
    • http://www.gorillawalker.com/evaluation-foundations-revisited-cultivating-a-life-of-the-mind-for.pdf
    • http://www.gorillawalker.com/fdny-certificate-of-fitness-place-of-assembly-exam-review-guide.pdf
    • http://www.gorillawalker.com/a-da-act-i-romanza-celeste-aida-bassoon-1-part.pdf
    • http://www.gorillawalker.com/emperor-waltz-kaiser-walzer-opus-437-strauss-easy-piano-sheet.pdf
    • http://www.gorillawalker.com/what-makes-us-human.pdf
    • http://www.gorillawalker.com/frozen-deluxe-colouring-book-deluxe-edition.pdf
    • http://www.gorillawalker.com/time-a-philosophical-introduction-digital.pdf
    • http://www.gorillawalker.com/outside-the-lines-sacred-standards-smooth-jazz-style-book.pdf
    • http://www.gorillawalker.com/mia-and-the-girl-with-a-twirl-my-first-i.pdf
    • http://www.gorillawalker.com/pink-y-say.pdf
    • http://www.gorillawalker.com/adults-only-sexual-stimulation-kindle-edition.pdf
    • http://www.gorillawalker.com/sheet-metal-handbook-how-to-form-and-shape-sheet-metal.pdf
    • http://www.gorillawalker.com/the-zoo-a-musical-folly-vocal-score-by-roderick-spencer.pdf
    • http://www.gorillawalker.com/statutory-supplement-to-employment-discrimination-law-sixth-edition.pdf
    • http://www.gorillawalker.com/t-34-85-vs-m26-pershing-duel-kindle-edition.pdf
    • http://www.gorillawalker.com/the-man-she-loved-and-other-love-stories.pdf
    • http://www.gorillawalker.com/cobuild-key-words-for-ielts-book-2-improver-collins-english.pdf
    • http://www.gorillawalker.com/indien-und-der-subkontinent-reisefuhrer-u-landerkunde-indien-pakistan-bangla.pdf
    • http://www.gorillawalker.com/101-sound-light-and-power-ic-projects.pdf
    • http://www.gorillawalker.com/the-co-occurring-disorders-treatment-planner.pdf
    • http://www.gorillawalker.com/east-o-the-sun-and-west-o-the-moon-with.pdf
    • http://www.gorillawalker.com/the-disease-to-please-curing-the-people-pleasing-syndrome.pdf
    • http://www.gorillawalker.com/2009-48-cfr-chapter-3-6-2009-title-48-federal.pdf
    • http://www.gorillawalker.com/tunisia-the-changing-muslim-parties-part-17-brief-article-statistical.pdf
    • http://www.gorillawalker.com/buddha-of-infinite-light-the-teachings-of-shin-buddhism-the.pdf
    • http://www.gorillawalker.com/breakthrough-networking-building-relationships-that-last-second-edition.pdf
    • http://www.gorillawalker.com/istanbul-manzaralari.pdf
    • http://www.gorillawalker.com/how-to-organize-and-manage-your-art-room.pdf
    • http://www.gorillawalker.com/out-of-the-woods-kindle-edition.pdf
    • http://www.gorillawalker.com/the-chinese-cook-book-hardcover.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.