Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5b941205801fdbf…

MALICIOUS

PDF

42.2 KB Created: 2018-12-07 18:27:42 +03:00 Authoring application: dvips(k) 5.99 Copyright 2010 Radical Eye Software (via Acrobat Distiller 9.4.5 (Windows))
MD5: 30ba429a72472144605f7eb335194c8b SHA-1: cdeaba2b6d73e4820f791cdf558d84bf27cb98bd SHA-256: f5b941205801fdbfd7893a7815f737de094603975935fb58ced2e85c2fcb5e68
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The primary purpose appears to be directing users to a vast collection of PDF files hosted on www.gorillawalker.com, likely for SEO manipulation or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/orders-is-orders-stories-from-the-golden-age-english-and.pdf
    • http://www.gorillawalker.com/you-can-run-glyph-warrior-book-2.pdf
    • http://www.gorillawalker.com/massage-and-manual-therapy-for-orthopedic-conditions-lww-massage-therapy.pdf
    • http://www.gorillawalker.com/all-sidestreets-titles-dream-racer-lorimer-sidestreets.pdf
    • http://www.gorillawalker.com/social-inclusion-in-schools-improving-outcomes-raising-standards-david-fulton.pdf
    • http://www.gorillawalker.com/the-natural-pharmacist-your-complete-guide-to-heart-disease-prevention.pdf
    • http://www.gorillawalker.com/mexico-houses-interiors.pdf
    • http://www.gorillawalker.com/molecular-spectroscopy-oxford-chemistry-primers.pdf
    • http://www.gorillawalker.com/new-venture-strategies-revised-edition-2nd-edition.pdf
    • http://www.gorillawalker.com/employer-strategy-and-the-labour-market-social-change-and-economic.pdf
    • http://www.gorillawalker.com/encyclopedia-of-biodiversity-five-volume-set.pdf
    • http://www.gorillawalker.com/indonesia-map-sulawesi-sheet-6-nelles-map.pdf
    • http://www.gorillawalker.com/gettysburg-kindle-edition.pdf
    • http://www.gorillawalker.com/the-9-mm-solution-kindle-edition.pdf
    • http://www.gorillawalker.com/arid-dune-ecosystems-the-nizzana-sands-in-the-negev-desert.pdf
    • http://www.gorillawalker.com/extreme-sports-getting-the-edge-conditioning-injuries-and-legal-illicit.pdf
    • http://www.gorillawalker.com/learn-the-premium-telescopes-online-business-networking-secrets.pdf
    • http://www.gorillawalker.com/fun-on-the-billiard-table-being-a-collection-of-amusing.pdf
    • http://www.gorillawalker.com/value-songbooks-1990s-2000s-hits-pvg.pdf
    • http://www.gorillawalker.com/giving-an-invitation-for-a-positive-response-closing-the-deal.pdf
    • http://www.gorillawalker.com/sports-cars-the-complete-sports-car-book.pdf
    • http://www.gorillawalker.com/generate-thousands-on-ebay-amazon-cashing-in-on-used-phones.pdf
    • http://www.gorillawalker.com/a-practical-introduction-to-phonetics-oxford-textbooks-in-linguistics.pdf
    • http://www.gorillawalker.com/the-harvard-business-school-guide-to-careers-in-the-nonprofit.pdf
    • http://www.gorillawalker.com/time-out-argentina-and-uruguay-perfect-places-to-stay-eat.pdf
    • http://www.gorillawalker.com/wanted-dead-or-alive.pdf
    • http://www.gorillawalker.com/sleep-better-10-tips-to-sleep-better-use-these-easy.pdf
    • http://www.gorillawalker.com/arizona-america-the-beautiful.pdf
    • http://www.gorillawalker.com/great-negotiating-skills-the-essential-guide-to-getting-what-you.pdf
    • http://www.gorillawalker.com/african-christian-theology.pdf
    • http://www.gorillawalker.com/managing-electronic-records-fourth-edition.pdf
    • http://www.gorillawalker.com/tales-of-the-punjab-folklore-of-india.pdf
    • http://www.gorillawalker.com/social-constructionist-theories-of-crime-the-library-of-essays-in.pdf
    • http://www.gorillawalker.com/donald-davidson-a-short-introduction.pdf
    • http://www.gorillawalker.com/6-children-s-pieces-op-69-piano-solo.pdf
    • http://www.gorillawalker.com/mccall-s-cooking-school-recipe-card-pasta-rice-15-baked.pdf
    • http://www.gorillawalker.com/veins-the-veins-cycle-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/nemii-no-1.pdf
    • http://www.gorillawalker.com/theory-of-superconductivity-advanced-books-classics-revised-edition-by-schrieffer.pdf
    • http://www.gorillawalker.com/encyclopedia-of-american-cut-and-engraved-glass-1880-1917-vol.pdf
    • http://www.gorillawalker.com/the-natural-pharmacist-your-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.