Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2398945a030d7f9…

MALICIOUS

PDF

46.5 KB Created: 2018-12-14 20:38:14 +03:00 Authoring application: calibre 2.23.0 [http://calibre-ebook.com]
MD5: 83c29d8af8bdb3e66999c62378f0d22f SHA-1: 526d22d2d6d1b822686529b5b49ca94d0a8d502f SHA-256: b2398945a030d7f91165e16d1c13145057b78df2d2545ca9bf24dc0eb39b5d83
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. The embedded URLs point to a domain that appears to be used for hosting numerous PDF files, suggesting a link farm or content distribution network for potentially malicious documents. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/ancient-memphis-enduring-is-the-perfection-proceedings-of-the-international.pdf
    • http://www.gorillawalker.com/joint-surgery-up-to-date.pdf
    • http://www.gorillawalker.com/listen-to-the-heron-s-words-reimagining-gender-and-kinship.pdf
    • http://www.gorillawalker.com/modern-language-review-109-2-april-2014.pdf
    • http://www.gorillawalker.com/revisions-of-the-palm-genus-syagrus-mart-and-other-selected.pdf
    • http://www.gorillawalker.com/the-best-of-good-living-with-jane-asher-creative-ideas.pdf
    • http://www.gorillawalker.com/econometrics-alchemy-or-science-essays-in-econometric-methodology.pdf
    • http://www.gorillawalker.com/alternate-connection-a-countermeasure-series-novel.pdf
    • http://www.gorillawalker.com/abs-on-the-ball-a-pilates-approach-to-building-superb.pdf
    • http://www.gorillawalker.com/new-testament-people-god-v1-christian-origins-and-the-question.pdf
    • http://www.gorillawalker.com/the-coven.pdf
    • http://www.gorillawalker.com/cherry-lane-shrek-the-musical-arranged-for-piano-vocal-and.pdf
    • http://www.gorillawalker.com/the-new-orientalists-postmodern-representations-of-islam-from-foucault-to.pdf
    • http://www.gorillawalker.com/alfred-s-basic-adult-all-in-one-piano-course-alfred.pdf
    • http://www.gorillawalker.com/electric-vegetarian-natural-cooking-the-food-processor-way.pdf
    • http://www.gorillawalker.com/a-different-shade-of-gray-midlife-and-beyond-in-the.pdf
    • http://www.gorillawalker.com/calendario-solar-maya-2012-2016-puras-raices-mayas-spanish-edition.pdf
    • http://www.gorillawalker.com/mas-alla-de-la-izquierda-y-la-derecha-beyond-left.pdf
    • http://www.gorillawalker.com/by-lee-anne-dobbins-healthy-smoothie-recipes-healthy-herbal-smoothies.pdf
    • http://www.gorillawalker.com/texts-from-jane-eyre-and-other-conversations-with-your-favorite.pdf
    • http://www.gorillawalker.com/environmental-contexts-and-disability-research-in-social-science-and-disability.pdf
    • http://www.gorillawalker.com/odes-of-ghalib-persian-to-urdu-translation-urdu-edition.pdf
    • http://www.gorillawalker.com/pink-me-up.pdf
    • http://www.gorillawalker.com/2003-code-of-federal-regulations-title-50-wildlife-and-fisheries.pdf
    • http://www.gorillawalker.com/aids-related-cancers-pipeline-review-q2-2011-download-pdf-digital.pdf
    • http://www.gorillawalker.com/basic-english-grammar-for-dummies-for-dummies-language-literature.pdf
    • http://www.gorillawalker.com/amigurumi-two-crocheted-toys-for-me-and-you-and-baby.pdf
    • http://www.gorillawalker.com/practical-econometrics.pdf
    • http://www.gorillawalker.com/medical-nutrition-therapy-across-the-continuum-of-care-supplement-1.pdf
    • http://www.gorillawalker.com/beth-van-hoesen-2016-calendar.pdf
    • http://www.gorillawalker.com/strategies-for-teaching-learners-with-special-needs-8th-edition.pdf
    • http://www.gorillawalker.com/navigate-elementary-a2-class-audio-cds.pdf
    • http://www.gorillawalker.com/the-messianic-hope-is-the-hebrew-bible-really-messianic-nac.pdf
    • http://www.gorillawalker.com/the-dry-lands-a-tribal-song-tales-of-the-koriba.pdf
    • http://www.gorillawalker.com/muddy-waters-the-mojo-man.pdf
    • http://www.gorillawalker.com/barcelona-crumpled-city-from-the-air-crumpled-city-map.pdf
    • http://www.gorillawalker.com/the-anarchist-reader.pdf
    • http://www.gorillawalker.com/off-screen-cinema-isidore-isou-and-the-lettrist-avant-garde.pdf
    • http://www.gorillawalker.com/assisted-human-reproduction-psychological-and-ethical-dilemmas.pdf
    • http://www.gorillawalker.com/daniel-interpretation-a-bible-commentary-for-teaching-and-preaching.pdf
    • http://www.gorillawalker.com/the-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.