Malicious PDF — malware analysis report

Static analysis result for SHA-256 48818df659f05ac5…

MALICIOUS

PDF

41.9 KB Created: 2018-11-30 20:34:06 +03:00 Authoring application: calibre 0.9.36 [http://calibre-ebook.com]
MD5: a02f7a35b433430ee0be76647b4150eb SHA-1: 3364d72fe06858d4e7841722fac167b18c4c6f2d SHA-256: 48818df659f05ac5fd470a02dca0031acedf8ecd5f18ca6ef83312c5803b0c84
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles on the gorillawalker.com domain. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be a link farm designed to manipulate search engine results or redirect users to potentially harmful content hosted on these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/little-lamb-baby-soft-cloth-book-baby-blessings.pdf
    • http://www.gorillawalker.com/viking-thrall-historical-romance-medieval-viking-kindle-edition.pdf
    • http://www.gorillawalker.com/contemporary-australian-plays-the-hotel-sorrento-dead-white-males-two.pdf
    • http://www.gorillawalker.com/igloos-in-the-summer-kindle-edition.pdf
    • http://www.gorillawalker.com/the-happy-baby-duckling-and-jesus.pdf
    • http://www.gorillawalker.com/the-essential-ken-wilber-an-introductory-reader-kindle-edition.pdf
    • http://www.gorillawalker.com/the-uncensored-boris-godunov-the-case-for-pushkin-s-original.pdf
    • http://www.gorillawalker.com/the-no-nonsense-guide-to-conflict-and-peace-no-nonsense.pdf
    • http://www.gorillawalker.com/determination-of-mbts-and-tcmbt-in-municipal-and-industrial-wastewaters.pdf
    • http://www.gorillawalker.com/the-breaking-of-the-american-social-compact.pdf
    • http://www.gorillawalker.com/abstract-algebra-an-introduction-to-groups-rings-and-fields.pdf
    • http://www.gorillawalker.com/resolving-conflict-in-your-marriage-homebuilders.pdf
    • http://www.gorillawalker.com/the-new-healing-herbs-the-essential-guide-to-more-than.pdf
    • http://www.gorillawalker.com/multiple-paths-to-literacy-assessment-and-differentiated-instruction-for-diverse.pdf
    • http://www.gorillawalker.com/little-miss-whoops-and-the-garden-goof-up-the-mr.pdf
    • http://www.gorillawalker.com/zen-running.pdf
    • http://www.gorillawalker.com/essential-elements-for-strings-2000-book-1-double-bass-a.pdf
    • http://www.gorillawalker.com/soltanto-per-te-italian-edition.pdf
    • http://www.gorillawalker.com/the-cruise-of-the-alerte-the-narrative-of-a-search.pdf
    • http://www.gorillawalker.com/meeting-evil-a-novel.pdf
    • http://www.gorillawalker.com/encyclopedia-of-cell-biology.pdf
    • http://www.gorillawalker.com/iron-hans-a-grimms-fairy-tale-grimms-fairy-tales.pdf
    • http://www.gorillawalker.com/super-model-all-for-art-miscellany-collection.pdf
    • http://www.gorillawalker.com/doctor-who-the-daleks.pdf
    • http://www.gorillawalker.com/detection-estimation-and-modulation-theory-part-iii.pdf
    • http://www.gorillawalker.com/source-selection-step-by-step-a-working-guide-for-every.pdf
    • http://www.gorillawalker.com/tax-for-australians-for-dummies.pdf
    • http://www.gorillawalker.com/peeps-a-candy-coated-tale.pdf
    • http://www.gorillawalker.com/misook-and-her-two-men.pdf
    • http://www.gorillawalker.com/microwave-magnetics.pdf
    • http://www.gorillawalker.com/365-dogs-page-a-day-calendar-2011.pdf
    • http://www.gorillawalker.com/optical-signal-processing-computing-and-neural-networks.pdf
    • http://www.gorillawalker.com/cross-stitch-a-beautiful-christmas.pdf
    • http://www.gorillawalker.com/a-patient-s-point-of-view-observations-of-a-chiropractic.pdf
    • http://www.gorillawalker.com/fish-cooking-made-easy.pdf
    • http://www.gorillawalker.com/fractal-cuts-exploring-the-magic-of-fractals-with-pop-up.pdf
    • http://www.gorillawalker.com/childhood-friendships-and-peer-relations-friends-and-enemies-international-texts.pdf
    • http://www.gorillawalker.com/hip-entertaining-bars-restaurants.pdf
    • http://www.gorillawalker.com/massachusetts-covered-bridges-images-of-america-images-of-america-series.pdf
    • http://www.gorillawalker.com/bescherelle-bescherelle-poche-orthographe-french-edition.pdf
    • http://www.gorillawalker.com/the-no-nonsense-guide-to-conflict-and-peace-no-nonsense.p
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.