Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1aa057901ca5346…

MALICIOUS

PDF

35.6 KB Created: 2019-08-07 05:46:16 +03:00 Authoring application: Acrobat PDFMaker 7.0 for Publisher (via Acrobat Distiller 7.0 (Windows))
MD5: f35495157e67d68120383d6d6bf90fe6 SHA-1: 20fbba03159c4ba7bf7f873cec45863560a1368a SHA-256: e1aa057901ca53465ef4921edd85882d6100f1d61f8da8b0bcfba43ae20897d0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, primarily hosted on www.gorillawalker.com. This behavior is indicative of a link farm or a redirection scheme designed to drive traffic to numerous other documents. The ML classifier also flagged this PDF as malicious with a high score. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8255

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/back-roads-california-eyewitness-travel-back-roads.pdf
    • http://www.gorillawalker.com/toxic-men-10-ways-to-identify-deal-with-and-heal.pdf
    • http://www.gorillawalker.com/paramedic-care-principles-practice-volumes-1-7-with-emstesting-com.pdf
    • http://www.gorillawalker.com/island-treasures-digital.pdf
    • http://www.gorillawalker.com/second-generation-korean-experiences-in-the-united-states-and-canada.pdf
    • http://www.gorillawalker.com/health-care-systems-in-transition-an-international-perspective.pdf
    • http://www.gorillawalker.com/el-c-digo-de-la-pureza-el-plan-de-dios.pdf
    • http://www.gorillawalker.com/pen-drawing-techniques-revised-general-higher-education-institutions-of-higher.pdf
    • http://www.gorillawalker.com/the-cranial-release-technique-how-crt-is-transforming-lives-by.pdf
    • http://www.gorillawalker.com/the-portuguese-period-in-east-africa.pdf
    • http://www.gorillawalker.com/1995-international-conference-on-acoustics-speech-and-signal-processing-5.pdf
    • http://www.gorillawalker.com/your-name-in-print-a-teen-s-guide-to-publishing.pdf
    • http://www.gorillawalker.com/visions-gourmandes-l-art-de-dresser-et-pr.pdf
    • http://www.gorillawalker.com/the-law-of-precipitation-how-to-successfully-meet-life-s.pdf
    • http://www.gorillawalker.com/e-study-guide-for-clinical-neuroanatomy-textbook-by-stephen-waxman.pdf
    • http://www.gorillawalker.com/cambridge-english-first-1-for-revised-exam-from-2015-student.pdf
    • http://www.gorillawalker.com/living-related-donor-liver-transplantation-assessment-of-graft-viability-based.pdf
    • http://www.gorillawalker.com/21-century-engineering-graphics-textbook-series-indoor-problem-set-design.pdf
    • http://www.gorillawalker.com/welcome-to-fairy-world-dora-and-friends-glitter-picturebook.pdf
    • http://www.gorillawalker.com/the-making-of-a-marchioness-classic-reprint.pdf
    • http://www.gorillawalker.com/the-formal-equality-theory-in-practice-the-inability-of-current.pdf
    • http://www.gorillawalker.com/top-10-new-york-city-dk-eyewitness-top-10-travel.pdf
    • http://www.gorillawalker.com/financial-accounting-and-reporting-a-global-perspective.pdf
    • http://www.gorillawalker.com/the-contemporary-hollywood-reader.pdf
    • http://www.gorillawalker.com/gli-eroi-dell-anticristianesimo-millenario-parallelismi-storici-di-anticristianesimo-le.pdf
    • http://www.gorillawalker.com/functional-equations-and-how-to-solve-them-problem-books-in.pdf
    • http://www.gorillawalker.com/ecuador-guia-azul-blue-guide-spanish-edition.pdf
    • http://www.gorillawalker.com/more-stress-anxiety-over-peanut-allergy-than-diabetes-lower-quality.pdf
    • http://www.gorillawalker.com/family-maps-of-pulaski-county-arkansas.pdf
    • http://www.gorillawalker.com/five-strides-on-the-banked-track-the-life-and-times.pdf
    • http://www.gorillawalker.com/cake-decorating-simplified-the-roth-method.pdf
    • http://www.gorillawalker.com/connect-plus-chemistry-with-learnsmart-2-semester-access-card-for.pdf
    • http://www.gorillawalker.com/they-looked-and-loved.pdf
    • http://www.gorillawalker.com/meditation-teen-mental-health.pdf
    • http://www.gorillawalker.com/graph-theory-and-combinatorics-1988-proceedings-annals-of-discrete-mathematics.pdf
    • http://www.gorillawalker.com/dead-lust-book-one-desire-death-and-danger.pdf
    • http://www.gorillawalker.com/bless-this-mouse-a-soft-to-touch-bookhandprint-books.pdf
    • http://www.gorillawalker.com/the-rough-guide-to-india-5-rough-guide-travel-guides.pdf
    • http://www.gorillawalker.com/quantum-description-of-high-resolution-nmr-in-liquids-international-series.pdf
    • http://www.gorillawalker.com/interpretation-of-three-dimensional-seismic-data-aapg-memoir-42.pdf
    • http://www.gorillawalker.com/the-portuguese-period-in-east-af
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.