Malicious PDF — malware analysis report

Static analysis result for SHA-256 eea7f39ec2e7d436…

MALICIOUS

PDF

44.7 KB Created: 2018-11-23 21:03:34 +03:00 Authoring application: PageMaker 6.5 (via Acrobat Distiller 3.01 for Windows)
MD5: 6e37842d12067de627d074fc205b1cb0 SHA-1: b7cd428a1869afb9867e46b30775f485c2191c65 SHA-256: eea7f39ec2e7d43625330c71f815affb6857e9235287911fbd6241b1595baa43
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files on the domain gorillawalker.com. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document. The primary attack pattern appears to be a link farm designed to direct users to a large number of external resources, potentially for SEO manipulation or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8683

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/student-learning-outcomes-and-law-school-assessment-a-practical-guide.pdf
    • http://www.gorillawalker.com/crystal-power-crystal-healing-the-complete-handbook.pdf
    • http://www.gorillawalker.com/small-animal-clinical-nutrition-iv.pdf
    • http://www.gorillawalker.com/dynamo-motor-and-switchboard-circuits-for-electrical-engineers-a-practical.pdf
    • http://www.gorillawalker.com/g-i-joe-america-s-elite-disavowed-volume-3.pdf
    • http://www.gorillawalker.com/teacher-this-is-what-i-want-to-be.pdf
    • http://www.gorillawalker.com/the-heart-speaks-a-cardiologist-reveals-the-secret-language-of.pdf
    • http://www.gorillawalker.com/hafiz-the-voice-of-god-a-hundred-odes-kindle-edition.pdf
    • http://www.gorillawalker.com/assassin-s-apprentice-the-farseer-trilogy-book-1.pdf
    • http://www.gorillawalker.com/french-political-thought-from-montesquieu-to-tocqueville-liberty-in-a.pdf
    • http://www.gorillawalker.com/grandmother-s-secrets-the-ancient-rituals-and-healing-power-of.pdf
    • http://www.gorillawalker.com/fluid-mechanics-for-chemical-engineers-chemical-engineering-series.pdf
    • http://www.gorillawalker.com/antonin-artaud-en-culturele-herbronning-dutch-edition.pdf
    • http://www.gorillawalker.com/the-aircraft-lift-the-flap-book.pdf
    • http://www.gorillawalker.com/an-introduction-to-health-economics-pharmacoeconomics-outcomes-research.pdf
    • http://www.gorillawalker.com/domenico-ferrabosco-il-primo-libro-de-madrigali-a-quatro-voci.pdf
    • http://www.gorillawalker.com/glorious-grandparenting.pdf
    • http://www.gorillawalker.com/dragon-keep-dle3-advanced-dungeons-and-dragons-dragonlance-module.pdf
    • http://www.gorillawalker.com/cuentos-maravillosos-de-la-antigua-china-japon-y-corea-spanish.pdf
    • http://www.gorillawalker.com/nurse-s-med-deck.pdf
    • http://www.gorillawalker.com/simone-de-beauvior-the-making-of-an-intellectual-woman.pdf
    • http://www.gorillawalker.com/the-house-by-the-sea-a-portrait-of-the-holocaust.pdf
    • http://www.gorillawalker.com/contemporary-topics-2-academic-listening-and-note-taking-skills-teacher.pdf
    • http://www.gorillawalker.com/they-say-i-say-the-moves-that-matter-in-academic.pdf
    • http://www.gorillawalker.com/survivors-a-novel-of-the-coming-collapse.pdf
    • http://www.gorillawalker.com/ways-of-knowing-selected-readings.pdf
    • http://www.gorillawalker.com/evangelical-faith-movement-in-ethiopia-origins-and-establishment-of-the.pdf
    • http://www.gorillawalker.com/information-systems-reengineering-for-modern-business-systems-erp-supply-chain.pdf
    • http://www.gorillawalker.com/living-sacrifice-willing-to-be-whittled-as-an-arrow.pdf
    • http://www.gorillawalker.com/blood-thunder-thirds-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/wisconsin-atlas-and-gazetteer-wisconsin-atlas-gazetteer.pdf
    • http://www.gorillawalker.com/grand-duets-for-piano-bk-2-8-elementary-pieces-for.pdf
    • http://www.gorillawalker.com/national-brands-and-private-labels-in-retailing-first-international-symposium.pdf
    • http://www.gorillawalker.com/a-century-of-royal-children-majesty.pdf
    • http://www.gorillawalker.com/night-and-day-cole-porter-sheet-music.pdf
    • http://www.gorillawalker.com/what-every-girl-wants-a-portrait-of-perfect-love-intimacy.pdf
    • http://www.gorillawalker.com/prevention-and-possible-cure-of-breast-digestive-and-prostate-cancers.pdf
    • http://www.gorillawalker.com/what-is-lean-six-sigma.pdf
    • http://www.gorillawalker.com/3013-salvation-3013-the-series-book-5-kindle-edition.pdf
    • http://www.gorillawalker.com/juvenile-justice.pdf
    • http://www.gorillawalker.com/teacher-this-is-what-i-wan
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.