Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb6b15d3a7142379…

MALICIOUS

PDF

39.5 KB Created: 2018-11-23 08:08:07 +03:00 Authoring application: Adobe Acrobat 6.02 (via Adobe Acrobat 6.0)
MD5: 3d0f090495d65ca02835a4f5887c8650 SHA-1: a6221802102695d1f8aba54843f02d9cd8151185 SHA-256: fb6b15d3a7142379e86139e648479abbf2e39f8f3240099039f14f4c58c963a3
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/spy-on-the-roof-of-the-world.pdf
    • http://www.gorillawalker.com/the-sibling-society.pdf
    • http://www.gorillawalker.com/the-wisdom-of-solomon-a-new-translation-with-introduction-and.pdf
    • http://www.gorillawalker.com/hiding-in-the-light-why-i-risked-everything-to-leave.pdf
    • http://www.gorillawalker.com/korean-folk-fairy-tales.pdf
    • http://www.gorillawalker.com/a-day-at-the-feminization-factory-2-transgender-transformation-tales.pdf
    • http://www.gorillawalker.com/kafka-s-dick-a-comedy.pdf
    • http://www.gorillawalker.com/nothing-without-god-n-w-g-the-12-volume-1.pdf
    • http://www.gorillawalker.com/bis-zum-ende-der-nacht-even-sinners-have-souls-german.pdf
    • http://www.gorillawalker.com/the-knowledge-of-the-holy.pdf
    • http://www.gorillawalker.com/i-moved-your-cheese.pdf
    • http://www.gorillawalker.com/touched-by-diabetes-guide-for-family-and-children-guide-for.pdf
    • http://www.gorillawalker.com/monster-trucks-roaring-rides.pdf
    • http://www.gorillawalker.com/2011-prince-edward-island-calendar.pdf
    • http://www.gorillawalker.com/repression-resistance-and-women-in-afghanistan.pdf
    • http://www.gorillawalker.com/henry-1-8-pocket-heroes.pdf
    • http://www.gorillawalker.com/bioinformatics-for-dna-sequence-analysis-methods-in-molecular-biology.pdf
    • http://www.gorillawalker.com/the-congo-wars-conflict-myth-and-reality.pdf
    • http://www.gorillawalker.com/the-journeying-boy-scenes-from-a-welsh-childhood-traveler.pdf
    • http://www.gorillawalker.com/rommel-leadership-lessons-from-the-desert-fox-world-generals-series.pdf
    • http://www.gorillawalker.com/the-enchanted-lake-of-the-fairy-morgana-from-the-orlando.pdf
    • http://www.gorillawalker.com/aws-development-essentials.pdf
    • http://www.gorillawalker.com/the-triathlete-s-guide-to-run-training-ultrafit-multisport-training.pdf
    • http://www.gorillawalker.com/carissimi.pdf
    • http://www.gorillawalker.com/jct-building-contract-for-home-owner-occupier-who-has-not.pdf
    • http://www.gorillawalker.com/public-administration-and-public-affairs-11th-edition.pdf
    • http://www.gorillawalker.com/excavations-at-kaminaljuyu-guatemala.pdf
    • http://www.gorillawalker.com/do-great-cases-make-bad-law.pdf
    • http://www.gorillawalker.com/farrell-s-irish-papers.pdf
    • http://www.gorillawalker.com/highest-apple-paperback.pdf
    • http://www.gorillawalker.com/planes-de-boda-spanish-edition.pdf
    • http://www.gorillawalker.com/the-crystal-sun-rediscovering-a-lost-technology-of-the-ancient.pdf
    • http://www.gorillawalker.com/notebooks-1960-1977.pdf
    • http://www.gorillawalker.com/birds-of-bolivia-2-0-aves-de-bolivia-2-0.pdf
    • http://www.gorillawalker.com/loving-one-another.pdf
    • http://www.gorillawalker.com/moment-by-moment-kindle-edition.pdf
    • http://www.gorillawalker.com/palliative-care-in-the-acute-hospital-setting-a-practical-guide.pdf
    • http://www.gorillawalker.com/concert-works-for-piano-and-orchestra-op-2-13-14.pdf
    • http://www.gorillawalker.com/spiritual-guides-of-the-third-century-a-semiotic-study-of.pdf
    • http://www.gorillawalker.com/dragon-lords-and-warriors-boxed-set-4-full-length-medieval.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.