Malicious PDF — malware analysis report

Static analysis result for SHA-256 99fbabadd34c4793…

MALICIOUS

PDF

45.6 KB Created: 2018-11-14 08:23:00 +03:00 Authoring application: calibre 0.9.31 [http://calibre-ebook.com]
MD5: a240c987365a97a474ffd17714a0cf4f SHA-1: b563ed3ec609e5f948048a6277d1614dcc4db115 SHA-256: 99fbabadd34c479318ecb1dff3bd95e1536fc1d22c9a31fe49a8d544167aa849
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files on the domain 'www.gorillawalker.com'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with a high probability. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8812

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/radar.pdf
    • http://www.gorillawalker.com/family-violence-my-parents-hurt-each-other-perspectives-on-relationships.pdf
    • http://www.gorillawalker.com/population-games-and-evolutionary-dynamics-economic-learning-and-social-evolution.pdf
    • http://www.gorillawalker.com/last-of-the-summer-wine-volume-1-four-bbc-radio.pdf
    • http://www.gorillawalker.com/the-winter-olympics-an-insider-s-guide-to-the-legends.pdf
    • http://www.gorillawalker.com/technical-communication.pdf
    • http://www.gorillawalker.com/one-illness-away-why-people-become-poor-and-how-they.pdf
    • http://www.gorillawalker.com/menopause-therapy-kindle-edition.pdf
    • http://www.gorillawalker.com/the-lustful-memoirs-of-a-young-and-passionated-girl-and.pdf
    • http://www.gorillawalker.com/dust-fairy-tales-absolutely-aggie.pdf
    • http://www.gorillawalker.com/internet-arabic-essential-middle-eastern-vocabularies.pdf
    • http://www.gorillawalker.com/el-dictador-la-historia-secreta-y-p-blica-de-jorge.pdf
    • http://www.gorillawalker.com/a-nile-river-food-chain-a-who-eats-what-adventure.pdf
    • http://www.gorillawalker.com/ghosts-of-gettysburg-ii-spirits-apparitions-and-haunted-places-of.pdf
    • http://www.gorillawalker.com/a-guide-for-nursing-home-social-workers-bylicsw.pdf
    • http://www.gorillawalker.com/low-carb-diet-for-beginners-25-healthy-delicious-low-carb.pdf
    • http://www.gorillawalker.com/primicias-para-dios-el-diezmo-seg-n-el-nuevo-testamento.pdf
    • http://www.gorillawalker.com/2006-essential-guide-to-retirement-planning-and-pensions-federal-government.pdf
    • http://www.gorillawalker.com/cape-to-cairo-the-journey-angels-on-our-shoulders.pdf
    • http://www.gorillawalker.com/the-collector-s-encyclopedia-of-salt-pepper-shakers-figural-and.pdf
    • http://www.gorillawalker.com/our-artist-in-cuba-peru-spain-and-algiers-leaves-from.pdf
    • http://www.gorillawalker.com/echo-in-the-darkness-mark-of-the-lion-series-2.pdf
    • http://www.gorillawalker.com/sierra-club-guides-to-the-national-parks-of-the-pacific.pdf
    • http://www.gorillawalker.com/my-sister-marilyn-a-memoir-of-marilyn-monroe.pdf
    • http://www.gorillawalker.com/uppers-downers-all-arounders-physical-and-mental-effects-of-psychoactive.pdf
    • http://www.gorillawalker.com/engineering-for-human-computer-interaction-8th-ifip-international-conference-ehci.pdf
    • http://www.gorillawalker.com/analisis-economico-del-derecho-spanish-edition.pdf
    • http://www.gorillawalker.com/how-to-file-for-divorce-in-district-of-columbia-legal.pdf
    • http://www.gorillawalker.com/me-and-my-mate-jeffrey.pdf
    • http://www.gorillawalker.com/spirituality-at-work-10-ways-to-balance-your-life-on.pdf
    • http://www.gorillawalker.com/malibu-creek-state-park-trail-map-tom-harrison-maps.pdf
    • http://www.gorillawalker.com/project-management-interview-questions-made-easy-kindle-edition.pdf
    • http://www.gorillawalker.com/39102-05-concrete-reinforcement-safety-tg.pdf
    • http://www.gorillawalker.com/warhead.pdf
    • http://www.gorillawalker.com/averof-the-ship-that-changed-the-course-of-history.pdf
    • http://www.gorillawalker.com/business-notes-writing-personal-notes-that-build-professional-relationships-by.pdf
    • http://www.gorillawalker.com/life-in-the-house-of-cards-or-parenting-a-child.pdf
    • http://www.gorillawalker.com/femdom-prison-1-facesitting-punishment-and-correction.pdf
    • http://www.gorillawalker.com/large-sudoku-12x12-easy-to-extreme-volume-15-276-puzzles.pdf
    • http://www.gorillawalker.com/pigs-over-boulder.pdf
    • http://www.gorillawalker.com/the-winter-olympics-an-insider-s-guide-to-the-lege
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.