Malicious PDF — malware analysis report

Static analysis result for SHA-256 4fb1f5ff4a1ae748…

MALICIOUS

PDF

42.0 KB Created: 2018-12-03 17:05:43 +03:00 Authoring application: calibre 0.9.13 [http://calibre-ebook.com]
MD5: e45a7cce67d7c0ad115ac43e745cb2b4 SHA-1: 9f4929d06e4ef8b10f9be044a10c737f892793d9 SHA-256: 4fb1f5ff4a1ae748a1b72d206e5a7057fa8de1dafcbbbaceb46cd46173f08eb6
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains multiple embedded URLs pointing to book downloads on gorillawalker.com. The 'SE_PASSWORD_ARCHIVE_LURE' heuristic indicates that the document likely instructs the user to open a password-protected archive, a common tactic to evade static analysis. The ML classifier also flagged this PDF as malicious. The primary IOC is the first URL found in the document body, which is also listed in the heuristics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 3

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/fatal-shadows-the-adrien-english-mysteries-book-1.pdf
    • http://www.gorillawalker.com/unsung-songs-kindle-edition.pdf
    • http://www.gorillawalker.com/lush.pdf
    • http://www.gorillawalker.com/conqueror-a-novel-of-kublai-khan-the-khan-dynasty.pdf
    • http://www.gorillawalker.com/letters-to-seabiscuit.pdf
    • http://www.gorillawalker.com/analog-electronics-an-integrated-pspice-approach.pdf
    • http://www.gorillawalker.com/mcgraw-hill-spanish-amistades.pdf
    • http://www.gorillawalker.com/ancient-egypt-the-light-of-the-world.pdf
    • http://www.gorillawalker.com/when-it-all-falls-apart-find-healing-joy-and-victory.pdf
    • http://www.gorillawalker.com/tidings-of-comfort-and-joy-a-christmas-collection-of-carols.pdf
    • http://www.gorillawalker.com/how-to-read-kierkegaard-how-to-read.pdf
    • http://www.gorillawalker.com/the-road-to-the-king-the-tale-of-joseph-asher.pdf
    • http://www.gorillawalker.com/theme-pockets-october.pdf
    • http://www.gorillawalker.com/african-wildlife-in-black-and-white-author-und-holger-karius.pdf
    • http://www.gorillawalker.com/pressed-an-international-spy-thriller-reluctant-hero-book-2-unabridged.pdf
    • http://www.gorillawalker.com/strong-loving-and-wise-presiding-in-liturgy.pdf
    • http://www.gorillawalker.com/minimally-invasive-bariatric-and-metabolic-surgery-principles-and-technical-aspects.pdf
    • http://www.gorillawalker.com/operaciones-basicas-de-la-ingenieria-quimica-unit-operations.pdf
    • http://www.gorillawalker.com/a-rhetoric-of-the-decameron-toronto-italian-studies.pdf
    • http://www.gorillawalker.com/star-of-the-sea.pdf
    • http://www.gorillawalker.com/the-energetics-of-western-herbs-treatment-strategies-integrating-western-oriental.pdf
    • http://www.gorillawalker.com/business-driven-technology.pdf
    • http://www.gorillawalker.com/the-snow-globe-journals.pdf
    • http://www.gorillawalker.com/dutch-soccer-drills-volume-5-kindle-edition.pdf
    • http://www.gorillawalker.com/faith-and-fatherland-parish-politics-in-hitler-s-germany.pdf
    • http://www.gorillawalker.com/encyclopedia-of-asian-history-4-volumes.pdf
    • http://www.gorillawalker.com/irac-law-lesson-for-law-students-look-inside.pdf
    • http://www.gorillawalker.com/fear-less-the-nine-lives-of-marc-sluszny.pdf
    • http://www.gorillawalker.com/the-book-of-soups.pdf
    • http://www.gorillawalker.com/ad-skyraider-in-action-aircraft-no-60.pdf
    • http://www.gorillawalker.com/old-moore-s-horoscope-daily-astral-diary-2016-sagittarius-2016.pdf
    • http://www.gorillawalker.com/taken-roughly-2-a-taboo-erotica-boxed-sex.pdf
    • http://www.gorillawalker.com/yeshua-mystic-christianity-and-the-path-to-christ-consciousness.pdf
    • http://www.gorillawalker.com/milton-s-visual-imagination-imagery-in-paradise-lost.pdf
    • http://www.gorillawalker.com/the-development-of-aggression-in-early-childhood-master-work-series.pdf
    • http://www.gorillawalker.com/neil-jordan-contemporary-film-directors.pdf
    • http://www.gorillawalker.com/the-red-velvet-seat-women-s-writings-on-the-cinema.pdf
    • http://www.gorillawalker.com/memory-inside-macintosh.pdf
    • http://www.gorillawalker.com/living-with-gluten-allergy-how-to-deal-with-gluten-allergy.pdf
    • http://www.gorillawalker.com/half-lit-houses.pdf
    • http://www.gorillawalker.com/t
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.