Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c6d5945f026f83c…

MALICIOUS

PDF

43.8 KB Created: 2019-02-14 08:13:05 +03:00 Authoring application: calibre 0.9.36 [http://calibre-ebook.com]
MD5: 1c64ac7d0cd12617ed4fdcf92529089f SHA-1: 80ea620b96bc3ce13583185da643fb46f72cb443 SHA-256: 4c6d5945f026f83ce3d37f7e27843b4f981def8857339b0493c4148d45e85d1c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents on the same domain, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or a distribution mechanism for other malicious content. No scripts were extracted from this sample, and the document body was truncated, limiting further analysis of the exact intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8452

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/pop-quartets-for-all-e-flat-alto-saxophone-e-flat.pdf
    • http://www.gorillawalker.com/country-gospel-usa-e-z-play-today-volume-113.pdf
    • http://www.gorillawalker.com/healing-in-god-s-time-trusting-in-god-s-faithfulness.pdf
    • http://www.gorillawalker.com/science-in-court-issues-in-law-and-society.pdf
    • http://www.gorillawalker.com/the-journey-kentucky-brothers-book-1-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/true-stories-of-the-miracles-of-azusa-street-and-beyond.pdf
    • http://www.gorillawalker.com/preparacion-de-masas-y-piezas-carnicas-spanish-edition.pdf
    • http://www.gorillawalker.com/pagliacci-act-i-prologo-baritone-full-score-a3489.pdf
    • http://www.gorillawalker.com/general-belisarius-soldier-of-byzantium-the-life-of-belisarius-by.pdf
    • http://www.gorillawalker.com/kevin-garnett-sharing-the-american-dream-overcoming-adversity.pdf
    • http://www.gorillawalker.com/linux-for-embedded-and-real-time-applications-second-edition-embedded.pdf
    • http://www.gorillawalker.com/a-christmas-carol-puffin-classics.pdf
    • http://www.gorillawalker.com/spirituals-for-solo-singers-medium-low.pdf
    • http://www.gorillawalker.com/waves-on-fluid-interfaces-proceedings-of-a-symposium.pdf
    • http://www.gorillawalker.com/fever-pitch-kindle-edition.pdf
    • http://www.gorillawalker.com/equity-research-on-economic-inequality.pdf
    • http://www.gorillawalker.com/fourth-grade-geometry-success-sylvan-workbooks-math-workbooks.pdf
    • http://www.gorillawalker.com/history-of-byzantine-music-and-hymnography.pdf
    • http://www.gorillawalker.com/health-is-simple-disease-is-complicated.pdf
    • http://www.gorillawalker.com/moccasin-thunder-american-indian-stories-for-today.pdf
    • http://www.gorillawalker.com/organic-marijuana-soma-style-the-pleasures-of-cultivating-connoisseur-cannabis.pdf
    • http://www.gorillawalker.com/a-new-spiritual-home-progressive-christianity-at-the-grass-roots.pdf
    • http://www.gorillawalker.com/my-stepbrother-s-baby-a-baby-for-my-stepbrother-book.pdf
    • http://www.gorillawalker.com/the-hummus-cookbook-delicious-easy-hummus-recipes-that-go-great.pdf
    • http://www.gorillawalker.com/a-la-cama-hipo-spanish-edition.pdf
    • http://www.gorillawalker.com/radio-comedy.pdf
    • http://www.gorillawalker.com/art-of-traditional-thai-massage.pdf
    • http://www.gorillawalker.com/astrology-an-in-depth-look-into-the-zodiac-signs-become.pdf
    • http://www.gorillawalker.com/poetry-of-kings-the-classical-hindi-literature-of-mughal-india.pdf
    • http://www.gorillawalker.com/dictionary-of-microbiology-molecular-biology.pdf
    • http://www.gorillawalker.com/what-s-left-of-me-the-hybrid-chronicles.pdf
    • http://www.gorillawalker.com/recruitment-of-naughty-cows.pdf
    • http://www.gorillawalker.com/the-dance-of-the-intellect-studies-in-the-poetry-of.pdf
    • http://www.gorillawalker.com/how-to-stop-drinking-kindle-edition.pdf
    • http://www.gorillawalker.com/in-the-mood-b-flat-clarinet-with-piano-accompaniment.pdf
    • http://www.gorillawalker.com/twelve-feet-tall.pdf
    • http://www.gorillawalker.com/enam-rate-de-ti-el-valor-imprescindible-de-la-autoestima.pdf
    • http://www.gorillawalker.com/geometric-algebra-over-local-rings.pdf
    • http://www.gorillawalker.com/doce-cuentos-peregrinos-spanish-edition.pdf
    • http://www.gorillawalker.com/guide-to-safety-and-quality-assurance-for-the-transplantation-of.pdf
    • http://www.gorillawalker.com/science-in-court-issues-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.