Malicious PDF — malware analysis report

Static analysis result for SHA-256 f74343c094a07016…

MALICIOUS

PDF

46.2 KB Created: 2018-11-23 20:30:12 +03:00 Authoring application: - (via Acrobat Distiller Daemon 3.0 for Solaris 2.3 and later (SPARC))
MD5: b6af169516208f9c12dbe610f80e487f SHA-1: f96c6c700949a1fb8ddf6cdc3d0f3c82db1697a5 SHA-256: f74343c094a07016138612778295dbc3af110c2dc70d4e2c9ba3700b230484c8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document as malicious. The primary attack pattern involves directing users to a vast collection of links hosted on www.gorillawalker.com, suggesting a potential SEO poisoning or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/fane-of-the-forgotten-gods-dungeon-tiles-d-d-accessory.pdf
    • http://www.gorillawalker.com/incomes-and-the-welfare-state-essays-on-britain-and-europe.pdf
    • http://www.gorillawalker.com/history-of-the-eighty-sixth-regiment-illinois-volunteer-infantry-during.pdf
    • http://www.gorillawalker.com/gluten-free-slow-cooker-cookbook-delicious-recipes-for-a-gluten.pdf
    • http://www.gorillawalker.com/big-book-of-aa-all-12-steps-understand-and-complete.pdf
    • http://www.gorillawalker.com/xero-for-dummies.pdf
    • http://www.gorillawalker.com/blackbook-guide-to-philadelphia-2007.pdf
    • http://www.gorillawalker.com/from-pharma-to-device-sales-a-pocket-guide-for-pharmaceutical.pdf
    • http://www.gorillawalker.com/ecological-engineering-for-pest-management-advances-in-habitat-manipulation-for.pdf
    • http://www.gorillawalker.com/wigan-s-year-inside-story-of-the-rugby-league-champions.pdf
    • http://www.gorillawalker.com/heat-and-sacrifice-in-the-vedas.pdf
    • http://www.gorillawalker.com/music-an-appreciation-6th-brief-edition-annotated-instructor-s-edition.pdf
    • http://www.gorillawalker.com/the-lost-stories-book-11-ranger-s-apprentice.pdf
    • http://www.gorillawalker.com/high-temperature-thruster-technology-for-spacecraft-propulsion-sudoc-nas-1.pdf
    • http://www.gorillawalker.com/angelhead-my-brother-s-descent-into-madness.pdf
    • http://www.gorillawalker.com/the-sanford-guide-to-antimicrobial-therapy-2013.pdf
    • http://www.gorillawalker.com/crisis-of-abundance-rethinking-how-we-pay-for-health-care.pdf
    • http://www.gorillawalker.com/clinical-functional-mri-presurgical-functional-neuroimaging-medical-radiology.pdf
    • http://www.gorillawalker.com/rope-latex-water.pdf
    • http://www.gorillawalker.com/puppy-love-volume-6-kindle-edition.pdf
    • http://www.gorillawalker.com/ataque-cardiaco-subito-sudden-heart-attack-como-prevenirlo-facilmente-how.pdf
    • http://www.gorillawalker.com/the-ancient-history-of-the-egyptians-carthaginians-assyrians-babylonians-medes.pdf
    • http://www.gorillawalker.com/duane-michals-photofile.pdf
    • http://www.gorillawalker.com/hot-sexy-nude-model-sexy-photos.pdf
    • http://www.gorillawalker.com/horse-book-recognition-and-treatment-of-common-horse-and-pony.pdf
    • http://www.gorillawalker.com/chaucer-and-array-chaucer-studies.pdf
    • http://www.gorillawalker.com/auger-and-x-ray-photoelectron-spectroscopy-in-materials-science-a.pdf
    • http://www.gorillawalker.com/shattered-consequences.pdf
    • http://www.gorillawalker.com/recipes-from-wales-113-traditional-welsh-recipes.pdf
    • http://www.gorillawalker.com/applying-total-quality-management-concepts-to-land-administration-a-systematic.pdf
    • http://www.gorillawalker.com/malt-lymphoma-an-entry-from-thomson-gale-s-gale-encyclopedia.pdf
    • http://www.gorillawalker.com/auditorium-to-bandage-digital-concordance-book-8-digital-concordance-of.pdf
    • http://www.gorillawalker.com/embedded-systems-design.pdf
    • http://www.gorillawalker.com/redeeming-economics-rediscovering-the-missing-element-culture-of-enterprise.pdf
    • http://www.gorillawalker.com/buffalo-cake-and-indian-pudding-penguin-great-food.pdf
    • http://www.gorillawalker.com/ipad-siri-for-dummies-ebook-set.pdf
    • http://www.gorillawalker.com/lectures-on-buildings-updated-and-revised.pdf
    • http://www.gorillawalker.com/tacitia-dean.pdf
    • http://www.gorillawalker.com/advanced-swearing-handbook.pdf
    • http://www.gorillawalker.com/tanzania-the-darling-of-the-donor-community-a-critical-review.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.