Malicious PDF — malware analysis report

Static analysis result for SHA-256 f13b4e13a60b55aa…

MALICIOUS

PDF

41.7 KB Created: 2018-12-11 20:46:50 +03:00 Authoring application: doPDF Ver 7.3 Build 391 (Windows 7 Home Premium Edition (SP 1) - Version: 6.1.7601 (x64))
MD5: adc97ccd8b9ebe7f45d834330bcd2532 SHA-1: ddb0fd8b56dc58e147e70a3573bc145b3b856962 SHA-256: f13b4e13a60b55aac9ba15e4b30c60f6fce4f9288330bd9f9144a2b1d4b04f73
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF documents on the domain 'www.gorillawalker.com'. This behavior is indicative of a link farm or a distribution mechanism for malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine the exact user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8469

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/a-simple-guide-to-chlamydia-treatment-and-related-diseases-a.pdf
    • http://www.gorillawalker.com/obras-completas-de-la-comision-corografica-geografia-fisica-y-politica.pdf
    • http://www.gorillawalker.com/production-research-an-introduction.pdf
    • http://www.gorillawalker.com/clinical-hematology-principles-procedures-correlations.pdf
    • http://www.gorillawalker.com/carole-king-new-threads-in-the-tapestry-original-survivors-patti.pdf
    • http://www.gorillawalker.com/the-death-of-adam-evolution-and-its-impact-on-western.pdf
    • http://www.gorillawalker.com/radio-receiver-design-electrical-and-computer-engineering.pdf
    • http://www.gorillawalker.com/summerall-on-and-off-the-air.pdf
    • http://www.gorillawalker.com/tsung-mi-and-the-sinification-of-buddhism-new-ed.pdf
    • http://www.gorillawalker.com/witching-you-were-here-wicked-witches-of-the-midwest-book.pdf
    • http://www.gorillawalker.com/seer-a-thriller-kindle-edition.pdf
    • http://www.gorillawalker.com/northern-germany-as-far-as-the-bavarian-and-austrian-frontiers.pdf
    • http://www.gorillawalker.com/the-dynamics-of-marine-craft-maneuvering-and-seakeeping.pdf
    • http://www.gorillawalker.com/historias-ins-litas-de-la-copa-libertadores-spanish-edition.pdf
    • http://www.gorillawalker.com/zero-risk-real-estate-creating-wealth-through-tax-liens-and.pdf
    • http://www.gorillawalker.com/valproic-acid-treatment-of-epilepsy-in-autistic-twins-an-article.pdf
    • http://www.gorillawalker.com/how-to-draw-musical-instruments-drawing-books-for-beginners-how.pdf
    • http://www.gorillawalker.com/100-questions-answers-about-high-blood-pressure-hypertension.pdf
    • http://www.gorillawalker.com/violencia-g-nero-y-migraci-n-en-el-caribe-hispano.pdf
    • http://www.gorillawalker.com/lying-and-kissing.pdf
    • http://www.gorillawalker.com/puskin-today.pdf
    • http://www.gorillawalker.com/wort-fur-wort-a-new-advanced-german-vocabulary.pdf
    • http://www.gorillawalker.com/if.pdf
    • http://www.gorillawalker.com/11-maths-year-5-7-testbook-1-standard-15-minute.pdf
    • http://www.gorillawalker.com/just-yorkie-puppies-2015-wall-calendar-just-willow-creek.pdf
    • http://www.gorillawalker.com/pants-with-pockets-and-other-tips-on-managing-an-add.pdf
    • http://www.gorillawalker.com/three-by-three-student-illustration-annual-2003.pdf
    • http://www.gorillawalker.com/concrete-evidence-detective-alec-ramsay-series-volume-6.pdf
    • http://www.gorillawalker.com/cryptic-crosswords-explained.pdf
    • http://www.gorillawalker.com/disturbing-the-peace.pdf
    • http://www.gorillawalker.com/in-the-wind-out-of-the-box-book-2-kindle.pdf
    • http://www.gorillawalker.com/don-t-worry-it-gets-worse-one-twentysomething-s-mostly.pdf
    • http://www.gorillawalker.com/deadly-ties.pdf
    • http://www.gorillawalker.com/labor-in-the-public-and-nonprofit-sectors-princeton-legacy-library.pdf
    • http://www.gorillawalker.com/ethics-in-professional-life.pdf
    • http://www.gorillawalker.com/scenes-for-actors-and-voices.pdf
    • http://www.gorillawalker.com/i-work-at-a-public-library-a-collection-of-crazy.pdf
    • http://www.gorillawalker.com/nevada-solar-energy-handbook.pdf
    • http://www.gorillawalker.com/claiming-ellie-the-preacher-s-girls.pdf
    • http://www.gorillawalker.com/radio-receiver-design-e
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.