Malicious PDF — malware analysis report

Static analysis result for SHA-256 fddacc630c023d23…

MALICIOUS

PDF

44.5 KB Created: 2019-03-17 07:22:12 +03:00 Authoring application: - (via Acrobat Distiller Daemon 3.0 for Solaris 2.3 and later (SPARC))
MD5: 9f0095e5b277cb280627574c471cc133 SHA-1: de0aae8cba4b27856c0881949f2f896100c83590 SHA-256: fddacc630c023d23714d0f0fc63de0434f92682aa12414779ca1216f7a3b572d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this sample as malicious. The primary attack pattern appears to be a link farm designed to direct users to a high volume of content on the gorillawalker.com domain, potentially for SEO manipulation or to serve as a distribution point for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8824

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/dancin-in-the-streets-anarchists-surrealists-situationists-provos-in-the.pdf
    • http://www.gorillawalker.com/mechwarrior-age-of-destruction-booster-pack.pdf
    • http://www.gorillawalker.com/direktinvestitionen-gr-nde-f-r-das-entstehen-von-multinationalen-unternehmen.pdf
    • http://www.gorillawalker.com/nutrition-in-early-life.pdf
    • http://www.gorillawalker.com/next-stop-nowhere.pdf
    • http://www.gorillawalker.com/constrained-deformation-of-materials-devices-heterogeneous-structures-and-thermo-mechanical.pdf
    • http://www.gorillawalker.com/insects-abroad-a-companion-volume-to-insects-at-home-being.pdf
    • http://www.gorillawalker.com/count-with-dora-dora-the-explorer.pdf
    • http://www.gorillawalker.com/the-architecture-of-bruce-goff.pdf
    • http://www.gorillawalker.com/one-bright-monster.pdf
    • http://www.gorillawalker.com/inherent-gifts-a-supernatural-slave-story.pdf
    • http://www.gorillawalker.com/adhd-research-practice-and-opinion.pdf
    • http://www.gorillawalker.com/history-of-the-american-cinema.pdf
    • http://www.gorillawalker.com/study-guide-for-1z0-055-oracle-database-11g-new-features.pdf
    • http://www.gorillawalker.com/type-specimens-of-lice-order-anoplura-in-the-united-states.pdf
    • http://www.gorillawalker.com/l-affido-condiviso-nella-separazione-e-nel-divorzio-manuale-pratico.pdf
    • http://www.gorillawalker.com/twentieth-century-rumania.pdf
    • http://www.gorillawalker.com/farewell-titanic-her-final-legacy.pdf
    • http://www.gorillawalker.com/folding-map-kuala-lumpur-penang-jal-city-guide-map-2009.pdf
    • http://www.gorillawalker.com/the-cherub-in-the-lily-field.pdf
    • http://www.gorillawalker.com/classical-recursion-theory-the-theory-of-functions-and-sets-of.pdf
    • http://www.gorillawalker.com/how-to-cook-delicious-thai-chicken-dishes-thai-food-recipes.pdf
    • http://www.gorillawalker.com/fortify-your-soul-40-letters-to-friends-seeking-purpose-and.pdf
    • http://www.gorillawalker.com/the-man-of-gold-authorized-translation-of-the-noted-venezuelan.pdf
    • http://www.gorillawalker.com/the-new-dictionary-of-cultural-literacy-what-every-american-needs.pdf
    • http://www.gorillawalker.com/by-mary-louise-turgeon-clinical-hematology-theory-and-procedures-fifth.pdf
    • http://www.gorillawalker.com/the-whole-brain-business-book.pdf
    • http://www.gorillawalker.com/fundamentals-of-organizational-communication-knowledge-sensitivity-skills-values.pdf
    • http://www.gorillawalker.com/working-and-poor-how-economic-and-policy-changes-are-affecting.pdf
    • http://www.gorillawalker.com/love-for-logan.pdf
    • http://www.gorillawalker.com/two-oceans-a-guide-to-the-marine-life-of-southern.pdf
    • http://www.gorillawalker.com/the-soil-its-nature-relations-and-fundamental-principles-of-management.pdf
    • http://www.gorillawalker.com/what-next.pdf
    • http://www.gorillawalker.com/memories-dreams-and-inner-voices.pdf
    • http://www.gorillawalker.com/violence-in-suzanne-collins-s-the-hunger-games-trilogy-social.pdf
    • http://www.gorillawalker.com/national-geographic-magazine-vol-137-no-2-february-1970.pdf
    • http://www.gorillawalker.com/the-vcs-of-world-war-i-final-days-1918-vcs.pdf
    • http://www.gorillawalker.com/feng-shui-learn-feng-shui-principles-to-improve-the-look.pdf
    • http://www.gorillawalker.com/forbidden-fruit-tastes-better-an-anthology-of-erotic-victorian-novels.pdf
    • http://www.gorillawalker.com/an-evil-mind-unabridged-digital.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.