Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f7e85915e86e32a…

MALICIOUS

PDF

44.9 KB Created: 2018-11-14 10:41:47 +03:00 Authoring application: calibre 0.9.13 [http://calibre-ebook.com]
MD5: ea30cac5ea0323a530c93e3015799519 SHA-1: 59bcaaedf06e5f2726baf81bcd1d59ffcf0b96ed SHA-256: 9f7e85915e86e32a7010bfb60165d99c1375f264834b24fbfef2d009feee3426
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by a critical heuristic for containing a large number of external links, suggesting a link farm or a method to distribute further malicious content. The ML classifier also indicated a high probability of maliciousness. While no scripts were extracted, the sheer volume of embedded URLs points towards a malicious intent, likely to redirect users to potentially harmful sites or to host further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8224

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/introduction-to-genetic-principles.pdf
    • http://www.gorillawalker.com/fracture-mechanics-for-structural-adhesive-bonds.pdf
    • http://www.gorillawalker.com/facing-the-wild-ecotourism-conservation-and-animal-encounters.pdf
    • http://www.gorillawalker.com/the-alcoholic-republic-an-american-tradition.pdf
    • http://www.gorillawalker.com/the-defence-of-boston-in-the-war-of-1812-15.pdf
    • http://www.gorillawalker.com/the-skull-volume-1-development.pdf
    • http://www.gorillawalker.com/medical-terminology-for-health-careers-second-edition-with-cd-and.pdf
    • http://www.gorillawalker.com/introduction-to-fiber-optics-systems.pdf
    • http://www.gorillawalker.com/interlaken.pdf
    • http://www.gorillawalker.com/missent-the-story-of-a-letter.pdf
    • http://www.gorillawalker.com/the-ministry-of-servers-second-edition-collegeville-ministry.pdf
    • http://www.gorillawalker.com/whose-property-the-deepening-conflict-between-private-property-and-democracy.pdf
    • http://www.gorillawalker.com/podcast-strategies-how-to-podcast-21-questions-answered.pdf
    • http://www.gorillawalker.com/town-and-square-from-the-agora-to-the-village-green.pdf
    • http://www.gorillawalker.com/everything-hong-kong-the-essential-living-guide.pdf
    • http://www.gorillawalker.com/paralysis-resource-guide-second-edition.pdf
    • http://www.gorillawalker.com/the-american-judiciary-the-scope-of-judicial-power-and-its.pdf
    • http://www.gorillawalker.com/netter-s-anatomy-flash-cards.pdf
    • http://www.gorillawalker.com/squirms-screams-and-squirts-the-workbook.pdf
    • http://www.gorillawalker.com/francisco-coronado-explorers-of-the-new-worlds.pdf
    • http://www.gorillawalker.com/generalized-poisson-distributions-statistics-a-series-of-textbooks-and-monographs.pdf
    • http://www.gorillawalker.com/epidemiology-and-biostatistics-an-introduction-to-clinical-research.pdf
    • http://www.gorillawalker.com/sport-and-social-exclusion-second-edition.pdf
    • http://www.gorillawalker.com/badminton-in-action-turtleback-school-library-binding-edition-sports-in.pdf
    • http://www.gorillawalker.com/colorado-for-the-50-traveler-an-altitude-superamerica-guide.pdf
    • http://www.gorillawalker.com/spark-bible-nrsv.pdf
    • http://www.gorillawalker.com/lennon-and-mccartney-for-violin.pdf
    • http://www.gorillawalker.com/biopsy-interpretation-of-the-gastrointestinal-tract-mucosa-biopsy-interpretation-series.pdf
    • http://www.gorillawalker.com/southern-bound-a-paranormal-mystery-max-porter-mysteries-book-1.pdf
    • http://www.gorillawalker.com/cuzco-and-machu-picchu.pdf
    • http://www.gorillawalker.com/facts-on-file-encyclopedia-of-black-women-in-america-social.pdf
    • http://www.gorillawalker.com/la-serrana-de-la-vera-coleccion-letras-hispanicas-letras-hispanicas.pdf
    • http://www.gorillawalker.com/god-s-promise-god-s-plan-your-possession-how-to.pdf
    • http://www.gorillawalker.com/advertising-and-promotion-an-integrated-marketing-communications-perspective-6th-edition.pdf
    • http://www.gorillawalker.com/international-marketing-book-only.pdf
    • http://www.gorillawalker.com/watercolor-painting-step-by-step.pdf
    • http://www.gorillawalker.com/reasonable-use-of-force-by-police-seizures-firearms-and-high.pdf
    • http://www.gorillawalker.com/300-best-jobs-without-a-four-year-degree.pdf
    • http://www.gorillawalker.com/the-battle-of-savate-32-battalion-s-greatest-operation.pdf
    • http://www.gorillawalker.com/hotel-moscow-a-novel.pdf
    • http://www.gorillawalker.com/medical-terminology-for-health-careers-second-edition-wit
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.