Malicious PDF — malware analysis report

Static analysis result for SHA-256 40daf0dfc1ea9e77…

MALICIOUS

PDF

42.8 KB Created: 2019-03-16 08:58:11 +03:00 Authoring application: calibre 0.9.31 [http://calibre-ebook.com]
MD5: bc9f6b456b5b7a4230ccc7e863b485ae SHA-1: 1a628caa4603db4029795ef727b82f5cebd040a5 SHA-256: 40daf0dfc1ea9e77281604d704720e71ba197718ea749d5e4d78b39e588fdfdb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier and contains a large number of embedded external links, a technique often used for SEO manipulation or to host malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this pattern. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of its specific intent beyond link farming.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/bass-walleye-boats-9-issues.pdf
    • http://www.gorillawalker.com/foreign-languages-for-everyone-how-i-learned-to-teach-second.pdf
    • http://www.gorillawalker.com/using-and-interpreting-statistics.pdf
    • http://www.gorillawalker.com/understanding-the-novel.pdf
    • http://www.gorillawalker.com/imaging-the-andes-shifting-margins-of-a-marginal-world-latin.pdf
    • http://www.gorillawalker.com/el-mono-inmaduro-spanish-edition-kindle-edition.pdf
    • http://www.gorillawalker.com/believe-in-miracles-but-trust-in-jesus.pdf
    • http://www.gorillawalker.com/acting-career-start-up-four-key-factors-for-success.pdf
    • http://www.gorillawalker.com/neurological-disorders-voluntary-health-agencies-and-other-patient-resources-sudoc.pdf
    • http://www.gorillawalker.com/the-roman-emperor-gaius-caligula-and-his-hellenistic-aspirations.pdf
    • http://www.gorillawalker.com/mel-bay-essentail-jazz-etudes-the-blues-for-trumpet.pdf
    • http://www.gorillawalker.com/sea-of-darkness-unraveling-the-mysteries-of-the-h-l.pdf
    • http://www.gorillawalker.com/techniques-in-extracorporeal-circulation-4e.pdf
    • http://www.gorillawalker.com/vive-sin-miedo-despierta-la-fuerza-interior-de-tu-alma.pdf
    • http://www.gorillawalker.com/the-caddisfly-family-phryganeidae-trichoptera.pdf
    • http://www.gorillawalker.com/who-should-melissa-marry.pdf
    • http://www.gorillawalker.com/mythologies-of-the-world-the-illustrated-guide-to-mythological-beliefs.pdf
    • http://www.gorillawalker.com/the-bible-in-brazil-colporter-experiences.pdf
    • http://www.gorillawalker.com/shostakovich.pdf
    • http://www.gorillawalker.com/recombination-in-semiconductors.pdf
    • http://www.gorillawalker.com/dk-spanish-english-bilingual-visual-dictionary.pdf
    • http://www.gorillawalker.com/low-voice-treasury-101-contemporary-and-time-honored-favorites.pdf
    • http://www.gorillawalker.com/the-world-of-the-unknown-ghosts.pdf
    • http://www.gorillawalker.com/babe-pigs-and-robbers-stepping-stone-book.pdf
    • http://www.gorillawalker.com/the-successdna-guide-to-real-estate-investment-management-essential-advice.pdf
    • http://www.gorillawalker.com/documentos-relativos-al-conflicto-de-jurisdicci-n-territorial-con-la.pdf
    • http://www.gorillawalker.com/classic-cars-2016-2017-two-year-planner.pdf
    • http://www.gorillawalker.com/seo-for-photographers-kindle-edition.pdf
    • http://www.gorillawalker.com/this-car.pdf
    • http://www.gorillawalker.com/the-dynamics-of-sunni-shia-relationships-doctrine-transnationalism-intellectuals-and.pdf
    • http://www.gorillawalker.com/venous-valves-morphology-function-radiology-surgery.pdf
    • http://www.gorillawalker.com/kiss-tell-kindle-edition.pdf
    • http://www.gorillawalker.com/peter-panzerfaust-deluxe-edition-volume-1-hc.pdf
    • http://www.gorillawalker.com/international-encyclopedia-of-marriage-and-family.pdf
    • http://www.gorillawalker.com/journal-your-life-s-journey-retro-journal-lined-journal-6.pdf
    • http://www.gorillawalker.com/nicaragua-canal-appendix-to-the-report-of-the-board-of.pdf
    • http://www.gorillawalker.com/los-angeles-county-a-day-hiker-s-guide.pdf
    • http://www.gorillawalker.com/hubble-space-telescope-six-battery-test-bed-sudoc-nas-1.pdf
    • http://www.gorillawalker.com/filemaker-pro-11-intermediate-vtc-training-cd.pdf
    • http://www.gorillawalker.com/the-minecraft-diary-trapped-in-auschwitz.pdf
    • http://www.gorillawalker
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.