Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4b9cde264c1def3…

MALICIOUS

PDF

44.4 KB Created: 2019-04-06 10:14:02 +03:00 Authoring application: Adobe Illustrator CS5.1 (via GPL Ghostscript 9.10)
MD5: 6bb275c7d6d266e100237fcb2e9d5e11 SHA-1: d0f670023e9ad784835f6e6b97774315d7dc392e SHA-256: f4b9cde264c1def3c8b797a4cb7ff4306ba719214a325d7fc6eb15de71df1056
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a 'PDF_SEO_LINK_FARM', indicating it embeds a large number of external links. The document body, though heavily obfuscated, contains references to URLs hosted on 'gorillawalker.com'. This suggests the primary purpose is to redirect users to a large number of other PDF documents, likely for SEO manipulation or to distribute further malicious content.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/henry-viii-and-the-reformation-in-england-access-to-history.pdf
    • http://www.gorillawalker.com/male-homosexuality-in-west-germany-between-persecution-and-freedom-1945.pdf
    • http://www.gorillawalker.com/neuengland-reisef-hrer-reisen-tag-f-r-tag-german-edition.pdf
    • http://www.gorillawalker.com/story-of-the-titanic.pdf
    • http://www.gorillawalker.com/great-rivals-in-history-when-politics-gets-personal.pdf
    • http://www.gorillawalker.com/john-fowles-a-reference-companion.pdf
    • http://www.gorillawalker.com/paleo-smoothies-superfood-paleo-smoothie-recipes-for-weight-loss-energy.pdf
    • http://www.gorillawalker.com/john-deere-landscaping-lawn-care-the-complete-guide-to-a.pdf
    • http://www.gorillawalker.com/emergency-medicine-malpractice-third-edition.pdf
    • http://www.gorillawalker.com/from-opposition-to-power-taiwan-s-democratic-progressive-party.pdf
    • http://www.gorillawalker.com/the-control-and-treatment-of-internal-equine-parasites.pdf
    • http://www.gorillawalker.com/social-studies-2003-pupil-edition-grade-5-building-a-nation.pdf
    • http://www.gorillawalker.com/biomedical-chromatography-chemical-engineering-methods-and-technology.pdf
    • http://www.gorillawalker.com/the-power-of-presence-unlock-your-potential-to-influence-and.pdf
    • http://www.gorillawalker.com/intermolecular-complexes-the-role-of-van-der-waals-systems-in.pdf
    • http://www.gorillawalker.com/rethinking-medieval-translation.pdf
    • http://www.gorillawalker.com/compact-guide-munich-for-less-for-less-compact-guides.pdf
    • http://www.gorillawalker.com/exotic-bdsm-club-a-werespirit-s-desire-exotic-bdsm-club.pdf
    • http://www.gorillawalker.com/homemade-spice-pastes-top-50-most-delicious-spice-paste-recipes.pdf
    • http://www.gorillawalker.com/lonely-planet-finland-travel-guide-by-lonely-planet-2012-paperback.pdf
    • http://www.gorillawalker.com/38-basic-joseki-elementary-go-series-vol-2.pdf
    • http://www.gorillawalker.com/honourable-friends-parliament-and-the-fight-for-change.pdf
    • http://www.gorillawalker.com/the-language-of-first-order-logic-including-the-windows-program.pdf
    • http://www.gorillawalker.com/kissing-golf-the-keep-it-simple-stupid-instructional-method.pdf
    • http://www.gorillawalker.com/study-and-problem-solving-guide-to-accompany-principles-of-modern.pdf
    • http://www.gorillawalker.com/space-mating-bbw-scifi-billionaire-martians-interracial-book-1.pdf
    • http://www.gorillawalker.com/rain-of-terror-a-blacklick-valley-mystery-the-blacklick-valley.pdf
    • http://www.gorillawalker.com/in-a-cheesemaker-s-kitchen-celebrating-25-years-of-artisanal.pdf
    • http://www.gorillawalker.com/seizure-disorders-in-children-a-self-instructional-program-unknown-binding.pdf
    • http://www.gorillawalker.com/taking-chances-derrida-psychoanalysis-and-literature-psychiatry-and-the-humanities.pdf
    • http://www.gorillawalker.com/great-menus-seasonal-recipes-for-entertaining.pdf
    • http://www.gorillawalker.com/test-collect-and-document-data-scientific-method-in-action.pdf
    • http://www.gorillawalker.com/technical-communication-in-the-global-community-2nd-edition.pdf
    • http://www.gorillawalker.com/street-luge-racing-extreme-sports-series.pdf
    • http://www.gorillawalker.com/my-rural-broadband-journey-the-one-year-trail-to-high.pdf
    • http://www.gorillawalker.com/amazon-echo-amazon-echo-user-guide-unlock-the-hidden-potential.pdf
    • http://www.gorillawalker.com/billerica-ma-images-of-america.pdf
    • http://www.gorillawalker.com/air-america-the-playbook-what-a-bunch-of-left-wing.pdf
    • http://www.gorillawalker.com/fan-engineering.pdf
    • http://www.gorillawalker.com/iguanas-really-wild-reptiles.pdf
    • http://www.gorillawalker.com/paleo-smoothies-superfood-paleo
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.