Malicious PDF — malware analysis report

Static analysis result for SHA-256 f17a871a274d249e…

MALICIOUS

PDF

44.6 KB Created: 2018-12-15 20:01:29 +03:00 Authoring application: - (via Python PDF Library - http://pybrary.net/pyPdf/)
MD5: f43964e71ee8fa26db9489dc10989f6b SHA-1: 99454d127bf9b7ad59b6bd86ee1ce2a58a1573f5 SHA-256: f17a871a274d249e08e28500a1f1a6fbbf6895bab88bea6b345d6820f442a2f4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a link farm hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8642

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/common-plants-of-nunavut.pdf
    • http://www.gorillawalker.com/schussler-tissue-salts-for-horses-healthy-and-fit-with-minerals.pdf
    • http://www.gorillawalker.com/chronic-fatigue-syndrome-the.pdf
    • http://www.gorillawalker.com/nile-valley-civilizations.pdf
    • http://www.gorillawalker.com/beyond-innocence-beyond-book-6.pdf
    • http://www.gorillawalker.com/astronomy-understanding-celestial-bodies-study-of-science.pdf
    • http://www.gorillawalker.com/arranged-by-nelson-riddle.pdf
    • http://www.gorillawalker.com/leaving-the-distractions-of-single-parenthood.pdf
    • http://www.gorillawalker.com/twenty-problem-solving-skills.pdf
    • http://www.gorillawalker.com/caramel-yaoi-yaoi-manga.pdf
    • http://www.gorillawalker.com/the-modern-world-ten-great-writers.pdf
    • http://www.gorillawalker.com/die-m-we-jonny-mit-farbigen-bildern-der-klasse-4b.pdf
    • http://www.gorillawalker.com/mtel-communication-and-literacy-skills-01-practice-test-2.pdf
    • http://www.gorillawalker.com/it-all-turns-on-affection-the-jefferson-lecture-and-other.pdf
    • http://www.gorillawalker.com/the-vitamin-e-factor-the-miraculous-antioxidant-for-the-prevention.pdf
    • http://www.gorillawalker.com/hover-dam-applying-problem-solving-strategies-powermath.pdf
    • http://www.gorillawalker.com/the-dust-rose-like-smoke-the-subjugation-of-the-zulu.pdf
    • http://www.gorillawalker.com/the-power-of-interdependence-lessons-from-africa.pdf
    • http://www.gorillawalker.com/diccionario-esencial-de-matematicas-coleccion-vox-10-spanish-edition.pdf
    • http://www.gorillawalker.com/arubot-hashamayim-the-floodgates-of-heaven-the-ancient-jewish-secret.pdf
    • http://www.gorillawalker.com/it-s-all-greek-to-me-confessions-of-an-unlikely.pdf
    • http://www.gorillawalker.com/impossible-dream-the-marcoses-the-aquinos-and-the-unfinished-revolution.pdf
    • http://www.gorillawalker.com/technician-s-guide-to-fiber-optics-4e-4th-edition-by.pdf
    • http://www.gorillawalker.com/the-girls-of-summer-the-u-s-women-s-soccer.pdf
    • http://www.gorillawalker.com/hymnal-published-by-authority-of-the-general-assembly-of-the.pdf
    • http://www.gorillawalker.com/foreign-taxes-and-the-growing-share-of-u-s-multinational.pdf
    • http://www.gorillawalker.com/edinburgh-a-novel.pdf
    • http://www.gorillawalker.com/egypt-and-india-and-the-origins-of-hinduism-vedanta-yoga.pdf
    • http://www.gorillawalker.com/study-guide-print-for-fire-and-emergency-services-instructor.pdf
    • http://www.gorillawalker.com/thunder-struck-thunder-on-the-mountain-series-volume-2.pdf
    • http://www.gorillawalker.com/understanding-bird-behaviour-digital.pdf
    • http://www.gorillawalker.com/aids-world-famous-scientist-gives-you-fact-without-fiction.pdf
    • http://www.gorillawalker.com/chinese-culture-and-mental-health.pdf
    • http://www.gorillawalker.com/hal-leonard-rubank-concert-and-contest-collection-viola-piano-accompaniment.pdf
    • http://www.gorillawalker.com/the-learning-lane-cars.pdf
    • http://www.gorillawalker.com/important-dates-a-season-of-sitting-the-spirit-of-comfort.pdf
    • http://www.gorillawalker.com/interpretation-and-social-criticism-tanner-lectures-on-human-values.pdf
    • http://www.gorillawalker.com/i-vespri-siciliani-libretto.pdf
    • http://www.gorillawalker.com/us-army-technical-manual-tm-55-1905-219-14-9.pdf
    • http://www.gorillawalker.com/violence-of-action-the-untold-stories-of-the-75th-ranger.pdf
    • http://pybrary.net/pyPdf/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.