Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3536b94721ed4a0…

MALICIOUS

PDF

42.9 KB Created: 2019-01-06 08:03:53 +03:00 Authoring application: LaTeX with hyperref package (via PDFlib PLOP 2.0.0p6 (SunOS)/Acrobat Distiller 5.0.5 (Windows))
MD5: d83637611be93e7bc1b5b9d501e0ffc3 SHA-1: d775e189e13640d3dad783f57957371935b23ad7 SHA-256: e3536b94721ed4a06d2c908443d56e6b3d08ad7b81fd4cf9597124baf57a0a1a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files on the domain www.gorillawalker.com. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document. The embedded URLs suggest a link farm or redirection strategy, likely intended to manipulate search engine results or distribute malicious content disguised as legitimate documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/targeting-texas-assessment-reproducible-grade-3.pdf
    • http://www.gorillawalker.com/a-history-of-surgery-at-cook-county-hospital.pdf
    • http://www.gorillawalker.com/swift-for-beginners-develop-and-design.pdf
    • http://www.gorillawalker.com/the-russian-question-nationalism-modernization-and-post-communist-russia.pdf
    • http://www.gorillawalker.com/the-emergence-and-linguistic-background-of-judaeo-arabic-a-study.pdf
    • http://www.gorillawalker.com/supply-chain-management-5th-edition.pdf
    • http://www.gorillawalker.com/little-mook-and-dwarf-longnose.pdf
    • http://www.gorillawalker.com/tide-pools-harpercollins-nature-study-book.pdf
    • http://www.gorillawalker.com/sermons-from-the-national-cathedral-soundings-for-the-journey.pdf
    • http://www.gorillawalker.com/transworld-snowboarding-magaine-the-truth-about-filming-a-video-part.pdf
    • http://www.gorillawalker.com/el-f-tbol-soccer-1001-fotos-1001-photos-spanish-edition.pdf
    • http://www.gorillawalker.com/a-black-parent-s-handbook-to-educating-your-children-outside.pdf
    • http://www.gorillawalker.com/laura-charlotte.pdf
    • http://www.gorillawalker.com/more-than-welcome-learning-to-embrace-gay-lesbian-bisexual-and.pdf
    • http://www.gorillawalker.com/lower-extremity-soft-tissue-cutaneous-plastic-surgery-paperback-1e.pdf
    • http://www.gorillawalker.com/algorithmic-lateral-and-frontal-cephalometrics-volume-1.pdf
    • http://www.gorillawalker.com/united-states-cuban-relations-a-critical-history.pdf
    • http://www.gorillawalker.com/university-of-missouri-men-s-basketball-guide.pdf
    • http://www.gorillawalker.com/sushi-die-beliebtesten-rezepte-german-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/dermatological-signs-of-internal-disease-expert-consult-online-and-print.pdf
    • http://www.gorillawalker.com/why-we-re-all-romans-the-roman-contribution-to-the.pdf
    • http://www.gorillawalker.com/how-to-hot-rod-your-fender-amp.pdf
    • http://www.gorillawalker.com/gardenia-sunrise-where-love-prevails-a-novel.pdf
    • http://www.gorillawalker.com/a-synopsis-of-the-birds-of-india-and-pakistan-together.pdf
    • http://www.gorillawalker.com/celebrations-cookie-bouquets-for.pdf
    • http://www.gorillawalker.com/365-views-from-the-sunny-side-of-life-365-perpetual.pdf
    • http://www.gorillawalker.com/seeing-europe-with-famous-authors-volume-viii-italy-sicily-and.pdf
    • http://www.gorillawalker.com/top-country-hits-of-2011-2012.pdf
    • http://www.gorillawalker.com/milady-s-standard-cosmetology-2012-theory-workbook-exam-review-printed.pdf
    • http://www.gorillawalker.com/from-shadow-to-reality-a-study-of-the-relationship-between.pdf
    • http://www.gorillawalker.com/project-planning-control-using-primavera-p6-oracle-primavera-p6-versions.pdf
    • http://www.gorillawalker.com/the-sixth-doctor-the-last-adventure-doctor-who.pdf
    • http://www.gorillawalker.com/catch-a-falling-heiress-an-american-heiress-in-london-unabridged.pdf
    • http://www.gorillawalker.com/build-your-own-robot-science-fair-project-prize-winning-science.pdf
    • http://www.gorillawalker.com/geophysics-part-a-laboratory-measurements-methods-in-experimental-physics-vol.pdf
    • http://www.gorillawalker.com/of-all-things.pdf
    • http://www.gorillawalker.com/notorious-notebooks-elegant-abstract-background-ruled-notebook-6-x-9.pdf
    • http://www.gorillawalker.com/the-new-alpinism-training-log.pdf
    • http://www.gorillawalker.com/sisterhood-and-solidarity-feminism-and-labor-in-modern-times.pdf
    • http://www.gorillawalker.com/international-handbook-of-earthquake-engineering-seismology-part-b-volume-81b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.