Malicious PDF — malware analysis report

Static analysis result for SHA-256 f288c8b64d6a15f5…

MALICIOUS

PDF

42.2 KB Created: 2019-01-06 08:24:38 +03:00 Authoring application: - (via ABBYY FineReader 9.0 Sprint)
MD5: e0c15170c382c9570ee2b627103ca889 SHA-1: f0d0c41b15bcce038f0af3d11189912a2e17fa00 SHA-256: f288c8b64d6a15f51947a57cef6a2fca5cf9284f15b0c28b9335768d0e83370d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a link farm hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8469

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/american-doctor.pdf
    • http://www.gorillawalker.com/mementos-of-mortality-cenotaphs-and-funerary-cairns-of-arainn.pdf
    • http://www.gorillawalker.com/role-playing-and-identity-the-limits-of-theatre-as-metaphor.pdf
    • http://www.gorillawalker.com/a-love-lost-and-found.pdf
    • http://www.gorillawalker.com/one-urge-one-plea-keep-me-trilogy-one-urge-one.pdf
    • http://www.gorillawalker.com/surrendering-your-life-for-god-s-pleasure.pdf
    • http://www.gorillawalker.com/hold-tight-willow-springs-ranch-volume-2.pdf
    • http://www.gorillawalker.com/haunting-fetus-abortion-sexuality-and-the-spirit-world-in-taiwan.pdf
    • http://www.gorillawalker.com/fuel-the-spark-5-guiding-values-for-success-in-law.pdf
    • http://www.gorillawalker.com/vita-adventures-of-a-volunteer-tax-preparer.pdf
    • http://www.gorillawalker.com/the-anne-pierson-award-for-young-writers-in-cumbria-2011.pdf
    • http://www.gorillawalker.com/what-the-h-ole-kindle-edition.pdf
    • http://www.gorillawalker.com/upstairs-downstairs-a-novelization-of-the-original-tv-series.pdf
    • http://www.gorillawalker.com/m-and-m-a-thriller.pdf
    • http://www.gorillawalker.com/no-ordinary-days.pdf
    • http://www.gorillawalker.com/practical-design-of-reinforced-concrete-structures.pdf
    • http://www.gorillawalker.com/short-epics-the-i-tatti-renaissance-library.pdf
    • http://www.gorillawalker.com/oxford-phonics-world-level-1-workbook.pdf
    • http://www.gorillawalker.com/saunders-medical-assisting-examination-review-1e-saunders-medical-assisting-exam.pdf
    • http://www.gorillawalker.com/rant.pdf
    • http://www.gorillawalker.com/social-capital-theory-and-research-sociology-and-economics-paper-2001.pdf
    • http://www.gorillawalker.com/my-brother-loved-snowflakes-the-story-of-wilson-a-bentley.pdf
    • http://www.gorillawalker.com/denim-from-cowboys-to-catwalks-a-visual-history-of-the.pdf
    • http://www.gorillawalker.com/gem-testing-tenth-edition.pdf
    • http://www.gorillawalker.com/daddy-s-gone.pdf
    • http://www.gorillawalker.com/shirley.pdf
    • http://www.gorillawalker.com/storybranding-tm-2-0-second-edition-creating-stand-out-brands.pdf
    • http://www.gorillawalker.com/the-ocean-basins-and-margins-vol-6-the-indian-ocean.pdf
    • http://www.gorillawalker.com/deep-in-a-dream-la-larga-noche-de-chet-baker.pdf
    • http://www.gorillawalker.com/otherworld-chronicles-the-invisible-tower.pdf
    • http://www.gorillawalker.com/where-i-belong.pdf
    • http://www.gorillawalker.com/outpouring-of-the-soul-rabbi-nachman-s-path-in-meditation.pdf
    • http://www.gorillawalker.com/advances-in-urethane-science-technology-volume-xii.pdf
    • http://www.gorillawalker.com/rites-of-passage.pdf
    • http://www.gorillawalker.com/thomas-jeffersons-library-a-catalog-with-his-entries-in-his.pdf
    • http://www.gorillawalker.com/the-illustrated-autocad-quick-reference-2013-and-beyond.pdf
    • http://www.gorillawalker.com/what-s-eating-you-people-and-parasites-unabridged-audible-audio.pdf
    • http://www.gorillawalker.com/hamlet-retold-in-modern-day-english-tales-from-shakespeare.pdf
    • http://www.gorillawalker.com/when-christ-comes.pdf
    • http://www.gorillawalker.com/food-in-tibetan-life.pdf
    • http://www.gorillawalker.com/fuel-the-spark-5-guiding-values-for-succ
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.