Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8bb213749fcea50…

MALICIOUS

PDF

38.8 KB Created: 2018-11-23 21:03:46 +03:00 Authoring application: PrimoPDF http://www.primopdf.com/ (via PrimoPDF)
MD5: afe846e17adeb829957e9c967c6b1213 SHA-1: f08412ff992daf0d93580b4e325e056b43aa64e3 SHA-256: f8bb213749fcea503669a8cfd96f2660849b0b3c0cce381b88f261e6a7293f2d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or SEO manipulation tactic. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the sheer volume of links to external PDFs hosted on 'gorillawalker.com' points towards a content-distribution or redirection scheme, potentially leading to malicious sites or further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8500

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/severin-s-veterinary-ophthalmology-notes.pdf
    • http://www.gorillawalker.com/the-hymns-of-job-and-other-poems-lannan-translations-selection.pdf
    • http://www.gorillawalker.com/nixon-and-mao-the-week-that-changed-the-world.pdf
    • http://www.gorillawalker.com/black-like-me.pdf
    • http://www.gorillawalker.com/bob-marley-soccer-2010-wall-calendar.pdf
    • http://www.gorillawalker.com/ali-khamenei-modern-world-leaders.pdf
    • http://www.gorillawalker.com/the-prairie-winnows-out-its-own-river-country-of-south.pdf
    • http://www.gorillawalker.com/agra.pdf
    • http://www.gorillawalker.com/teachers-retirement-system-information-representative-passbooks-career-examination-ser-c.pdf
    • http://www.gorillawalker.com/the-romance-of-tristan-and-isolt.pdf
    • http://www.gorillawalker.com/dementia-contemporary-neurology-series.pdf
    • http://www.gorillawalker.com/dk-readers-winking-blinking-wiggling-waggling-level-2-beginning-to.pdf
    • http://www.gorillawalker.com/s-m-a-r-t-s-and-the-missing-ufo.pdf
    • http://www.gorillawalker.com/soil-and-water-contamination-2nd-edition-balkema-proceedings-and-monographs.pdf
    • http://www.gorillawalker.com/nassau-and-paradise-island-kindle-edition.pdf
    • http://www.gorillawalker.com/construction-economics-a-new-approach.pdf
    • http://www.gorillawalker.com/przewalski-s-horse-the-history-and-biology-of-an-endangered.pdf
    • http://www.gorillawalker.com/products-liability-and-safety-cases-and-materials-case-and-statutory.pdf
    • http://www.gorillawalker.com/fischer-tropsch-refining.pdf
    • http://www.gorillawalker.com/automotive-ergonomics-driver-vehicle-interaction.pdf
    • http://www.gorillawalker.com/ten-fun-things-to-do-in-seoul.pdf
    • http://www.gorillawalker.com/neighborhoods-california-edition-grade-2.pdf
    • http://www.gorillawalker.com/das-maya-orakel-buch-und-44-farbkarten-das-kodierte-wissen.pdf
    • http://www.gorillawalker.com/can-t-remember-what-i-forgot-the-good-news-from.pdf
    • http://www.gorillawalker.com/mastering-fashion-marketing-palgrave-master-series.pdf
    • http://www.gorillawalker.com/canoe-trip-alone-in-the-maine-wilderness-kindle-edition.pdf
    • http://www.gorillawalker.com/advances-in-organometallic-chemistry-vol-28.pdf
    • http://www.gorillawalker.com/a-history-of-brazil-myth-and-poetics.pdf
    • http://www.gorillawalker.com/moby-dick-or-the-whale.pdf
    • http://www.gorillawalker.com/exposed-exposed-series.pdf
    • http://www.gorillawalker.com/the-art-of-participation-1950-to-now-hardback-common.pdf
    • http://www.gorillawalker.com/dancing-move-your-body-a-kid-s-guide-to-fitness.pdf
    • http://www.gorillawalker.com/atlas-maior-hollandia-et-belgica-french-edition.pdf
    • http://www.gorillawalker.com/delmar-s-clinical-medical-assisting.pdf
    • http://www.gorillawalker.com/the-ferret-handbook.pdf
    • http://www.gorillawalker.com/the-nearsighted-naturalist.pdf
    • http://www.gorillawalker.com/animate-creation-popular-edition-of-our-living-world-a-natural.pdf
    • http://www.gorillawalker.com/fine-art-digital-nature-photography.pdf
    • http://www.gorillawalker.com/community-in-the-digital-age-philosophy-and-practice.pdf
    • http://www.gorillawalker.com/andersonville.pdf
    • http://www.primopdf.com/
    • http://www.gorillawalker
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.