Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebea35775ec0e10a…

MALICIOUS

PDF

43.2 KB Created: 2018-12-14 20:07:30 +03:00 Authoring application: Adobe InDesign CS4 (6.0) (via Adobe PDF Library 9.0)
MD5: 9f99347239873fb1eadd56f16bd7447e SHA-1: 87f2c7e0e5a45f15e5b18799f50d286d1b06b66e SHA-256: ebea35775ec0e10a1526e4cdbca6022dafa8f2a032bae34cb5f17501251364d8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, primarily pointing to other PDF files on the domain www.gorillawalker.com. This suggests a link farm or a distribution mechanism for further malicious content, likely aimed at SEO manipulation or hosting malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-christmas-party-with-flibbet-jibbet-by-deborah-shaffer-the.pdf
    • http://www.gorillawalker.com/top-requested-christmas-sheet-music-piano-vocal-guitar-top-requested.pdf
    • http://www.gorillawalker.com/jane-from-the-heart.pdf
    • http://www.gorillawalker.com/frazetta-the-definitive-reference-pb-vanguard-classics.pdf
    • http://www.gorillawalker.com/reader-s-theater-and-so-much-more-grades-5-6.pdf
    • http://www.gorillawalker.com/new-difference-schemes-for-partial-differential-equations-operator-theory-advances.pdf
    • http://www.gorillawalker.com/henna-s-secret-history-the-history-mystery-folklore-of-henna.pdf
    • http://www.gorillawalker.com/1821-land-lottery-of-georgia.pdf
    • http://www.gorillawalker.com/le-morte-darthur-norton-critical-editions.pdf
    • http://www.gorillawalker.com/complete-guide-for-the-meeting-planner.pdf
    • http://www.gorillawalker.com/clinical-applications-of-artificial-neural-networks.pdf
    • http://www.gorillawalker.com/eliminate-colorectal-cancer-act-of-2001.pdf
    • http://www.gorillawalker.com/the-breakthrough-strategy-using-short-term-successes-to-build-the.pdf
    • http://www.gorillawalker.com/the-kingmaker-how-northern-dancer-founded-a-racing-dynasty.pdf
    • http://www.gorillawalker.com/modern-egyptian-art-1910-2003.pdf
    • http://www.gorillawalker.com/judging-privileged-jews-holocaust-ethics-representation-and-the-grey-zone.pdf
    • http://www.gorillawalker.com/when-bad-christians-happen-to-good-people-where-we-have.pdf
    • http://www.gorillawalker.com/electrical-construction-databook.pdf
    • http://www.gorillawalker.com/the-birth-of-god-the-bible-and-the-historian.pdf
    • http://www.gorillawalker.com/minecraft-zombie-fun-facts-an-unofficial-minecraft-book-minecraft-minecraft.pdf
    • http://www.gorillawalker.com/big-english-3-workbook-w-audiocd.pdf
    • http://www.gorillawalker.com/headlong.pdf
    • http://www.gorillawalker.com/remembering-the-phallic-mother-psychoanalysis-modernism-and-the-fetish.pdf
    • http://www.gorillawalker.com/the-ernst-young-business-plan-guide-ernst-young-business-guide.pdf
    • http://www.gorillawalker.com/business-and-competitive-analysis-effective-application-of-new-and-classic.pdf
    • http://www.gorillawalker.com/larmac-consolidated-index-to-the-laws-rules-and-constitution-of.pdf
    • http://www.gorillawalker.com/a-treatise-on-maritime-law-including-the-law-of-shipping.pdf
    • http://www.gorillawalker.com/the-pearson-lab-manual-for-developing-writers-volume-c-essays.pdf
    • http://www.gorillawalker.com/el-codice-rosetta-the-rosetta-codex-solaris-spanish-edition.pdf
    • http://www.gorillawalker.com/addie-meets-max-i-can-read-book-2.pdf
    • http://www.gorillawalker.com/toys-of-the-sixties-a-pictorial-price-guide.pdf
    • http://www.gorillawalker.com/life-from-light-is-it-possible-to-live-without-food.pdf
    • http://www.gorillawalker.com/maybe-one-day.pdf
    • http://www.gorillawalker.com/afrocentrism-and-world-politics-towards-a-new-paradigm.pdf
    • http://www.gorillawalker.com/olivia-tm-2013-wall-calendar.pdf
    • http://www.gorillawalker.com/blind-trust-large-groups-and-their-leaders-in-times-of.pdf
    • http://www.gorillawalker.com/alien-eggs-kindle-edition.pdf
    • http://www.gorillawalker.com/weather-to-sail-the-complete-guide-to-sailing-weather.pdf
    • http://www.gorillawalker.com/the-alaska-cruise-handbook-a-mile-by-mile-guide-2012.pdf
    • http://www.gorillawalker.com/a-field-guide-to-the-larger-mammals-of-tanzania-wildguides.pdf
    • http://www.gorillawalker.com/h
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.