Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed1cc1b7d99ab852…

MALICIOUS

PDF

45.2 KB Created: 2018-11-23 21:01:58 +03:00 Authoring application: Adobe PageMaker 6.52 (via Acrobat Distiller 3.01 for Windows)
MD5: 471de2d4afd67d79040d3777087964b8 SHA-1: 527101718c33b8209dcc373a7b17f9c7faaf084c SHA-256: ed1cc1b7d99ab852cbbbf5949a289d8f68a71bc4d4a64d88993a297fbaeef9b1
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing 32 external links to other PDF documents hosted on www.gorillawalker.com. While no scripts were extracted, the sheer volume of outbound links suggests a malicious intent, possibly for SEO manipulation or to serve as a distribution point for further malware. The document body is heavily obfuscated and unreadable, providing no direct clues to the user-facing lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-new-jamaica-describing-the-island-explaining-its-conditions-of.pdf
    • http://www.gorillawalker.com/fashion-careers-guidebook.pdf
    • http://www.gorillawalker.com/and-now-it-s-time-for-silly-songs-with-larry.pdf
    • http://www.gorillawalker.com/the-ancient-near-east-volume-1-an-anthology-of-texts.pdf
    • http://www.gorillawalker.com/a-witch-s-song-tales-of-evermagic-book-3-kindle.pdf
    • http://www.gorillawalker.com/antiwarriors-the-vietnam-war-and-the-battle-for-america-s.pdf
    • http://www.gorillawalker.com/mass-culture-in-soviet-russia-tales-poems-songs-movies-plays.pdf
    • http://www.gorillawalker.com/auntie-helen-mary-goes-to-little-thibet.pdf
    • http://www.gorillawalker.com/the-fighting-fifteenth-alabama-infantry-a-civil-war-history-and.pdf
    • http://www.gorillawalker.com/middle-grades-math-tools-for-success-course-3.pdf
    • http://www.gorillawalker.com/guided-meditations-for-calmness-awareness-and-love-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/life-in-a-risen-savior-kindle-edition.pdf
    • http://www.gorillawalker.com/a-brother-knocking-at-the-door.pdf
    • http://www.gorillawalker.com/day-trips-from-edmonton-best-of-alberta.pdf
    • http://www.gorillawalker.com/the-encyclopedia-of-practical-horticulture-a-reference-system-of-commercial.pdf
    • http://www.gorillawalker.com/investing-in-zero-coupon-bonds-all-about-cats-strips-tigers.pdf
    • http://www.gorillawalker.com/tigers-in-the-tempest-savannah-state-university-and-the-struggle.pdf
    • http://www.gorillawalker.com/op-met-shining-host-players-guide-mind-s-eye-theatre.pdf
    • http://www.gorillawalker.com/all-in-playing-the-fool-gambling-with-love-book-4.pdf
    • http://www.gorillawalker.com/dealing-with-dementia-a-guide-to-alzheimer-s-disease-and.pdf
    • http://www.gorillawalker.com/the-making-of-an-african-communist-edwin-thabo-mofutsanyana-and.pdf
    • http://www.gorillawalker.com/a-viking-s-love-kindle-edition.pdf
    • http://www.gorillawalker.com/global-economic-uncertainties-and-southeast-asian-economies.pdf
    • http://www.gorillawalker.com/bodies-in-motion-bicycling-cycling-and-physical-fitness-an-article.pdf
    • http://www.gorillawalker.com/liverworts-of-new-england-a-guide-for-the-amateur-naturalist.pdf
    • http://www.gorillawalker.com/good-morning-101-positive-sticky-notes-to-start-the-day.pdf
    • http://www.gorillawalker.com/separations-two-novels-of-mothers-and-children.pdf
    • http://www.gorillawalker.com/real-estate-investing-from-a-to-z-revised-edition.pdf
    • http://www.gorillawalker.com/vol-60-freddie-hubbard-book-cd-set-play-a-long.pdf
    • http://www.gorillawalker.com/palaeoecology-of-a-well-preserved-crinoid-colony-from-the-silurian.pdf
    • http://www.gorillawalker.com/first-start-french-ii-student-edition.pdf
    • http://www.gorillawalker.com/on-mars-pathfinder-the-mike-lane-stories-volume-1.pdf
    • http://www.gorillawalker.com/the-changing-landscape-of-food-governance-public-and-private-encounters.pdf
    • http://www.gorillawalker.com/dental-assisting-package.pdf
    • http://www.gorillawalker.com/an-elementary-treatise-on-fourier-s-series-and-spherical-cylindrical.pdf
    • http://www.gorillawalker.com/los-or-genes-del-poder-en-mesoam-rica-tezontle-spanish.pdf
    • http://www.gorillawalker.com/practical-tunnel-construction.pdf
    • http://www.gorillawalker.com/algebra-2-an-incremental-development-saxon-algebra.pdf
    • http://www.gorillawalker.com/handbook-of-flood-management-flood-recovery-innovation-and-response-management.pdf
    • http://www.gorillawalker.com/la-ciencia-prohibida-spanish-edition.pdf
    • http://www.gorillawalker
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.