Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2ff111c1a2e6059…

MALICIOUS

PDF

43.6 KB Created: 2018-11-23 08:00:50 +03:00 Authoring application: - (via iText 2.1.7 by 1T3XT)
MD5: d34891fb0e35129e287cdd87b389e3d0 SHA-1: 3526589fbe79ced38d04e75bfe0e36188cf5bb74 SHA-256: f2ff111c1a2e60597b5e7972ecfbab2ab5da022666173350b02abae782065a70
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and a critical heuristic for containing a large number of external links. These links point to various PDF files hosted on www.gorillawalker.com, suggesting a link farm or SEO manipulation tactic. The document body itself is heavily obfuscated and does not provide clear textual lures. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/cloud-9.pdf
    • http://www.gorillawalker.com/three-little-ducks-big-book.pdf
    • http://www.gorillawalker.com/the-work-of-literature.pdf
    • http://www.gorillawalker.com/die-meistersinger-von-n-rnberg-wwv-96-suite-for-orchestra.pdf
    • http://www.gorillawalker.com/elusive-consumption.pdf
    • http://www.gorillawalker.com/advice-to-a-young-black-actor-conversations-with-douglas-turner.pdf
    • http://www.gorillawalker.com/prestressed-concrete-structures-book-and-disk-prentice-hall-international-series.pdf
    • http://www.gorillawalker.com/on-the-steel-breeze-poseidons-children.pdf
    • http://www.gorillawalker.com/the-passion-with-in-birth-of-passionpreneurs-kindle-edition.pdf
    • http://www.gorillawalker.com/socialize-your-patient-engagement-strategy-how-social-media-and-mobile.pdf
    • http://www.gorillawalker.com/fundamentals-of-electronics-dc-circuits.pdf
    • http://www.gorillawalker.com/handbook-of-carbon-nano-materials-in-2-volumes-volume-7.pdf
    • http://www.gorillawalker.com/manage-cure-neck-pain-cervical-spondylosis.pdf
    • http://www.gorillawalker.com/the-mammoth-book-of-great-inventions.pdf
    • http://www.gorillawalker.com/tennessee-criminal-trial-practice-2009-2010-ed.pdf
    • http://www.gorillawalker.com/i-m-dancing-as-fast-as-i-can.pdf
    • http://www.gorillawalker.com/early-learning-activity-pack-letters-early-learning-activity-packs.pdf
    • http://www.gorillawalker.com/pablo-picasso-the-most-famous-artist-of-the-20th-century.pdf
    • http://www.gorillawalker.com/wampanoag-morning-stories-from-the-land-of-the-people-of.pdf
    • http://www.gorillawalker.com/catecismo-de-la-iglesia-catolica-spanish-edition.pdf
    • http://www.gorillawalker.com/the-gateway-to-spiritual-power.pdf
    • http://www.gorillawalker.com/the-practical-guide-to-medical-ethics-and-law.pdf
    • http://www.gorillawalker.com/the-alaska-cruise-handbook.pdf
    • http://www.gorillawalker.com/budismo-y-vacuidad-la-vida-tal-como-es-spanish-edition.pdf
    • http://www.gorillawalker.com/the-great-american-education-industrial-complex-ideology-technology-and-profit.pdf
    • http://www.gorillawalker.com/evaluation-analysis-and-documentation-support-for-the-10kw-signature-suppressed.pdf
    • http://www.gorillawalker.com/sammy-s-gold-stars-a-boy-discovers-that-special-food.pdf
    • http://www.gorillawalker.com/how-to-live-on-mars-how-to-hardcover-franklin-watts.pdf
    • http://www.gorillawalker.com/street-scenarios-for-the-emt-and-paramedic.pdf
    • http://www.gorillawalker.com/architect-s-guide-to-facility-programming-a-mcgraw-hill-publication.pdf
    • http://www.gorillawalker.com/fisioterapia-para-la-escoliosis-basada-en-el-diagnostico-spanish-edition.pdf
    • http://www.gorillawalker.com/plato-apology-greek-edition.pdf
    • http://www.gorillawalker.com/hans-andersen-s-stories-illustrated-by-jennie-harbour.pdf
    • http://www.gorillawalker.com/introduction-to-the-theory-of-entire-functions-volume-56-pure.pdf
    • http://www.gorillawalker.com/the-carnation-evaporated-milk-cookbook.pdf
    • http://www.gorillawalker.com/tratado-de-los-contratos-parte-general-spanish-edition.pdf
    • http://www.gorillawalker.com/david-busch-s-nikon-d60-guide-to-digital-slr-photography.pdf
    • http://www.gorillawalker.com/protest-politics-in-germany-movements-on-the-left-and-right.pdf
    • http://www.gorillawalker.com/frozen-in-time-alimanti-volume-1.pdf
    • http://www.gorillawalker.com/deep-time-of-the-media-toward-an-archaeology-of-hearing.pdf
    • http://www.gorillawalker.com/the-passion-with-in-birth-of-passionpre
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.