Malicious PDF — malware analysis report

Static analysis result for SHA-256 e94d3fd6ed360668…

MALICIOUS

PDF

33.4 KB Created: 2019-12-13 17:14:21 +03:00 Authoring application: Adobe Acrobat 6.02 (via Adobe Acrobat 6.0)
MD5: 1cf4f4d9a6ef5a51396f2bb0aac5789a SHA-1: 3f73facbdca53990045aaeefebc84148cea5f9b5 SHA-256: e94d3fd6ed360668e894665e7bc25f7b411c262aa4964549cef3083f0c36375f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. The primary attack pattern involves directing users to a vast collection of linked documents hosted on www.gorillawalker.com, likely as a form of SEO poisoning or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/noise-in-solid-state-devices-and-circuits.pdf
    • http://www.gorillawalker.com/the-artscroll-youth-megillah-fully-illustrated-with-the-complete-text.pdf
    • http://www.gorillawalker.com/out-west-mountains-and-coastline-a-pair-of-christian-western.pdf
    • http://www.gorillawalker.com/i-hate-reading-how-to-get-through-20-minutes-of.pdf
    • http://www.gorillawalker.com/outsource-competing-in-the-global-productivity-race.pdf
    • http://www.gorillawalker.com/sushi-easy-recipes-for-making-sushi-at-home.pdf
    • http://www.gorillawalker.com/labelings-of-discrete-structures-and-its-applications.pdf
    • http://www.gorillawalker.com/how-to-paint-citadel-miniatures-chinese-edition.pdf
    • http://www.gorillawalker.com/mastering-phpmyadmin-3-4-for-effective-mysql-management-kindle-edition.pdf
    • http://www.gorillawalker.com/behold-a-red-horse-2k-5-horsemen-of-the-apocalypse.pdf
    • http://www.gorillawalker.com/the-structure-of-production-new-revised-edition.pdf
    • http://www.gorillawalker.com/how-to-teach-online-and-make-100k-a-year.pdf
    • http://www.gorillawalker.com/wok-cookery.pdf
    • http://www.gorillawalker.com/dynamics-and-skills-of-group-counseling-sw-393r-26-theories.pdf
    • http://www.gorillawalker.com/the-paranormal-conspiracy-the-truth-about-ghosts-aliens-and-mysterious.pdf
    • http://www.gorillawalker.com/introduction-to-biomedical-engineering-2nd-edition.pdf
    • http://www.gorillawalker.com/heartsinger.pdf
    • http://www.gorillawalker.com/conscience-on-trial-why-i-was-detained-notes-of-a.pdf
    • http://www.gorillawalker.com/a-boy-in-10-000-bc-kindle-edition.pdf
    • http://www.gorillawalker.com/case-briefs-contracts-burton-4th-edition-case-briefs-by-rom.pdf
    • http://www.gorillawalker.com/the-elements-of-social-scientific-thinking.pdf
    • http://www.gorillawalker.com/low-back-pain-stiff-neck-care-exercise-it-yourself-2010.pdf
    • http://www.gorillawalker.com/accountability-not-ownership-labour-and-the-nhs-fabian-discussion-papers.pdf
    • http://www.gorillawalker.com/biological-aspects-of-disease.pdf
    • http://www.gorillawalker.com/the-life-and-voyages-of-christopher-columbus-a-tour-of.pdf
    • http://www.gorillawalker.com/teacher-express-teachers-edition-test-bank-teaching-resources-lesson-planner.pdf
    • http://www.gorillawalker.com/clinical-manual-for-nursing-assistants.pdf
    • http://www.gorillawalker.com/pasteleria-artesanal-homemade-pastry-200-recetas-de-reposteria-para-golosos.pdf
    • http://www.gorillawalker.com/the-old-testament-writings-history-literature-interpretation.pdf
    • http://www.gorillawalker.com/dividend-policy-its-impact-on-firm-value.pdf
    • http://www.gorillawalker.com/don-t-even-think-about-it-why-our-brains-are.pdf
    • http://www.gorillawalker.com/radar-absorbing-materials-from-theory-to-design-and-characterization.pdf
    • http://www.gorillawalker.com/polymers-for-high-technology-electronics-and-photonics-acs-symposium-series.pdf
    • http://www.gorillawalker.com/the-message-of-the-rosary-part-3-the-glorious-mysteries.pdf
    • http://www.gorillawalker.com/four-of-diamonds-an-australian-s-journey.pdf
    • http://www.gorillawalker.com/cunningham-s-text-book-of-anatomy-vol-i-human-embryology.pdf
    • http://www.gorillawalker.com/shadows-on-the-stars-the-great-tree-of-avalon-book.pdf
    • http://www.gorillawalker.com/the-bible-a-history-the-making-and-impact-of-the.pdf
    • http://www.gorillawalker.com/secret-garden-just-right-monthly-planner-calendar-2016.pdf
    • http://www.gorill
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.