Malicious PDF — malware analysis report

Static analysis result for SHA-256 f06d7eed602c932c…

MALICIOUS

PDF

45.8 KB Created: 2018-12-15 08:52:31 +03:00 Authoring application: PScript5.dll Version 5.2 (via ePapyrus PSI 8.51)
MD5: 98918920e558e9613611de4ca5b2d05f SHA-1: 1271633b544391c8ca17126b27ade186415539e4 SHA-256: f06d7eed602c932cbdb67aee25e66d109de14cbd44b9079b390c47b526c2e003
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a heuristic firing for a large number of external PDF links, all hosted on the same domain (www.gorillawalker.com). This suggests a link farm or SEO manipulation tactic. The ML classifier also flagged the PDF as malicious. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/inside-these-walls-a-probation-rejection-never-felt-sweeter.pdf
    • http://www.gorillawalker.com/the-vampire-rebellion-middle-english-edition.pdf
    • http://www.gorillawalker.com/joint-proceedings-of-the-american-society-of-photogrammetry-and-the.pdf
    • http://www.gorillawalker.com/cases-and-materials-on-arbitration-law-and-practice-5th-american.pdf
    • http://www.gorillawalker.com/calculation-of-high-angle-of-attack-aerodynamics-of-fighter-configurations.pdf
    • http://www.gorillawalker.com/caribbean-confusion-harlequin-comics.pdf
    • http://www.gorillawalker.com/the-cambridge-dictionary-of-human-biology-and-evolution.pdf
    • http://www.gorillawalker.com/sweet-secret-a-transexual-love-story-kindle-edition.pdf
    • http://www.gorillawalker.com/atlas-of-electroencephalography-in-the-dog-and-cat.pdf
    • http://www.gorillawalker.com/don-pasquale-vocal-score-cloth-italian.pdf
    • http://www.gorillawalker.com/subway-player-blackbook-cult-series-2-mser.pdf
    • http://www.gorillawalker.com/early-colorectal-cancer-korean-edition.pdf
    • http://www.gorillawalker.com/secuestrado-kidnapped-spanish-edition.pdf
    • http://www.gorillawalker.com/dental-metallurgy-a-manual-for-the-use-of-dental-students.pdf
    • http://www.gorillawalker.com/secret-intelligence-in-the-twentieth-century-studies-in-intelligence.pdf
    • http://www.gorillawalker.com/impromptu-man-j-l-moreno-and-the-origins-of-psychodrama.pdf
    • http://www.gorillawalker.com/madonna-as-postmodern-myth-how-one-star-s-self-construction.pdf
    • http://www.gorillawalker.com/a-first-course-in-geometry-dover-books-on-mathematics.pdf
    • http://www.gorillawalker.com/the-marriage-laws-of-nigeria.pdf
    • http://www.gorillawalker.com/the-third-screen-new-edition-the-ultimate-guide-to-mobile.pdf
    • http://www.gorillawalker.com/service-book-and-hymnal-of-the-lutheran-church-in-america.pdf
    • http://www.gorillawalker.com/ismaelillo-versos-libres-versos-sencillos-clasicos-universales-spanish-edition.pdf
    • http://www.gorillawalker.com/immersed-into-god-interactive-training-manual-pouring-out-the-life.pdf
    • http://www.gorillawalker.com/north-pacific-north-american-circulation-and-precipitation-anomalies-associated-with.pdf
    • http://www.gorillawalker.com/the-dance-of-the-caterpillars-bilingual-chinese-english-chinese-edition.pdf
    • http://www.gorillawalker.com/walking-and-jogging-for-health-and-wellness-cengage-learning-activity.pdf
    • http://www.gorillawalker.com/shipboard-operations-fm1-564-military-manuals-survival-ebooks-kindle-edition.pdf
    • http://www.gorillawalker.com/everyday-arguments-a-guide-to-writing-and-reading-effective-arguments.pdf
    • http://www.gorillawalker.com/the-great-gatsby-unabridged-cd-audiobook.pdf
    • http://www.gorillawalker.com/disney-s-snow-white-and-the-seven-dwarfs-an-animated.pdf
    • http://www.gorillawalker.com/slave-the-shame-glory-saga-volume-2.pdf
    • http://www.gorillawalker.com/lives-and-times-of-the-great-composers.pdf
    • http://www.gorillawalker.com/american-literature-volume-i-2nd-edition.pdf
    • http://www.gorillawalker.com/knowledge-and-freedom-in-indian-philosophy.pdf
    • http://www.gorillawalker.com/the-essential-guide-to-exteriors-home-building-remodeling-basics-home.pdf
    • http://www.gorillawalker.com/encyclopedia-of-polymer-science-and-technology-part-3-encyclopedia-of.pdf
    • http://www.gorillawalker.com/jewels-of-guidance-v-1-gems-from-the-lives-of.pdf
    • http://www.gorillawalker.com/denkmal-und-energie-german-edition.pdf
    • http://www.gorillawalker.com/201-careers-in-nursing-2nd-second-edition.pdf
    • http://www.gorillawalker.com/chaldaean-oracles-and-theurgy-mysticism-magic-and-platonism-in-the.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.