Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ff629f16ac27fcc…

MALICIOUS

PDF

44.3 KB Created: 2019-05-05 02:11:33 +03:00 Authoring application: calibre 2.23.0 [http://calibre-ebook.com]
MD5: 7306ddeabce00b7a001d12bf9a62eec6 SHA-1: 774667e03a74e318f0695e36d5f8672fc86a0c62 SHA-256: 4ff629f16ac27fcc9c29532908159e5552c68dd94e01f20704d51349f25befff
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this file as malicious. The primary attack pattern appears to be a link farm designed to drive traffic to other PDF documents hosted on the same domain, potentially for SEO manipulation or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/deadline-a-virgil-flowers-novel.pdf
    • http://www.gorillawalker.com/el-escudo-de-armas-de-juan-luis-vives-monograf-as.pdf
    • http://www.gorillawalker.com/knocked-up-by-my-professor.pdf
    • http://www.gorillawalker.com/die-dampfmaschine-in-ihrer-praktischen-anwendung-auf-eisenbahnen-und-dampfschifffahrt.pdf
    • http://www.gorillawalker.com/riding-fury-home-a-memoir-kindle-edition.pdf
    • http://www.gorillawalker.com/eminem-superstars-of-hip-hop.pdf
    • http://www.gorillawalker.com/amazing-feats-of-mechanical-engineering-great-achievements-in-engineering.pdf
    • http://www.gorillawalker.com/heat-exchangers-thermal-hydraulic-fundamentals-and-design.pdf
    • http://www.gorillawalker.com/adagio-und-variationen-fur-oboe-und-orchester-op-102.pdf
    • http://www.gorillawalker.com/cooking-with-herbs-spices-2003-publication.pdf
    • http://www.gorillawalker.com/the-slow-pace-of-fast-change-bringing-innovations-to-market.pdf
    • http://www.gorillawalker.com/the-ansyreeh-and-ismaeleeh-a-visit-to-the-secret-sects.pdf
    • http://www.gorillawalker.com/materials-science-and-engineering-properties.pdf
    • http://www.gorillawalker.com/discerning-what-counts-the-function-of-the-adiaphora-topos-in.pdf
    • http://www.gorillawalker.com/where-treasure-hides.pdf
    • http://www.gorillawalker.com/sonata-in-d-major-k-448-alfred-masterwork-edition.pdf
    • http://www.gorillawalker.com/hypermasculinities-in-the-contemporary-novel-cormac-mccarthy-toni-morrison-and.pdf
    • http://www.gorillawalker.com/state-overestimated-revenue-gain-from-new-video-poker-compensation-gambling.pdf
    • http://www.gorillawalker.com/bigger-than-me-kids-explore-philadelphia.pdf
    • http://www.gorillawalker.com/wanderlust-book-two-of-the-edgewood-series-volume-2.pdf
    • http://www.gorillawalker.com/wet-moon-volume-1-feeble-wanderings.pdf
    • http://www.gorillawalker.com/365-days-to-jump-start-your-prayer-life-365-days.pdf
    • http://www.gorillawalker.com/normal-accidents-living-with-high-risk-technologies.pdf
    • http://www.gorillawalker.com/hal-leonard-ukulele-heroes-the-golden-age.pdf
    • http://www.gorillawalker.com/the-maggid-speaks-favorite-stories-and-parables-of-rabbi-sholom.pdf
    • http://www.gorillawalker.com/wild-utah-falcon-guides-wild.pdf
    • http://www.gorillawalker.com/little-by-little-a-writer-s-education-puffin-story-books.pdf
    • http://www.gorillawalker.com/thelwell-s-pony-cavalcade-angels-on-horseback-a-leg-at.pdf
    • http://www.gorillawalker.com/occupational-health-and-safety-for-the-21st-century.pdf
    • http://www.gorillawalker.com/brodsky-through-the-eyes-of-his-contemporaries-vol-2-studies.pdf
    • http://www.gorillawalker.com/tap-in-the-dance-series-book-3.pdf
    • http://www.gorillawalker.com/a-people-s-history-of-the-united-states-the-civil.pdf
    • http://www.gorillawalker.com/pakistani-urdu-verse-an-anthology-poetry-from-pakistan-urdu-poems.pdf
    • http://www.gorillawalker.com/concerning-osteopathy.pdf
    • http://www.gorillawalker.com/e-my-name-is-emily.pdf
    • http://www.gorillawalker.com/drinking-molotov-cocktails-with-gandhi.pdf
    • http://www.gorillawalker.com/dracula-writer-s-digest-annotated-classics.pdf
    • http://www.gorillawalker.com/beginning-html-and-css.pdf
    • http://www.gorillawalker.com/rhode-island-wildlife-a-folding-pocket-guide-to-familiar-species.pdf
    • http://www.gorillawalker.com/coriolanus-at-the-national-th-interpretation-of-the-time.pdf
    • http://www.gorilla
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.