Malicious PDF — malware analysis report

Static analysis result for SHA-256 b643d45d7d9712d6…

MALICIOUS

PDF

43.7 KB Created: 2018-11-30 20:26:52 +03:00 Authoring application: calibre 0.9.36 [http://calibre-ebook.com]
MD5: 7a608c44e2992f1f9c715175ba011404 SHA-1: e538c2bd97705998ed4ecdebb844b864e78d5e48 SHA-256: b643d45d7d9712d6c8fa633278f8e1d7539b5d36fdb5b6218a49c61a57bdafdc
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. The PDF_SEO_LINK_FARM heuristic indicates this is a link farm, suggesting a malicious intent to manipulate search engine rankings or distribute further malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged the document as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8439

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/getting-to-grips-with-science-a-fresh-approach-for-the.pdf
    • http://www.gorillawalker.com/starship-s-mage-episode-5-kindle-edition.pdf
    • http://www.gorillawalker.com/the-elixir-of-love-l-elisir-d-amore-opera-score.pdf
    • http://www.gorillawalker.com/the-mystery-and-meaning-of-the-mass.pdf
    • http://www.gorillawalker.com/magic-aces-a-complete-routine-of-amazing-card-tricks.pdf
    • http://www.gorillawalker.com/issues-in-intimate-violence.pdf
    • http://www.gorillawalker.com/the-cambridge-introduction-to-russian-poetry-book-review-an-article.pdf
    • http://www.gorillawalker.com/thicker-than-blood-how-racial-statistics-lie.pdf
    • http://www.gorillawalker.com/loving-my-lot-a-young-mom-s-journey-to-contentment.pdf
    • http://www.gorillawalker.com/comptia-network-all-in-one-exam-guide-sixth-edition-exam.pdf
    • http://www.gorillawalker.com/conversations-on-harmony-1855-classic-texts-in-music-education.pdf
    • http://www.gorillawalker.com/straightling-a-memoir-hey-kid-series-book-2-kindle-edition.pdf
    • http://www.gorillawalker.com/riemann-s-zeta-function.pdf
    • http://www.gorillawalker.com/the-adventures-of-ebenezer-fox-in-the-revolutionary-war-1838.pdf
    • http://www.gorillawalker.com/blackmailed-by-my-mother-s-girlfriend-first-time-lesbian-dubious.pdf
    • http://www.gorillawalker.com/systems-engineering-gro.pdf
    • http://www.gorillawalker.com/campaign-manager-running-and-winning-local-elections-third-edition-3rd.pdf
    • http://www.gorillawalker.com/an-assault-on-my-senses-living-and-working-in-central.pdf
    • http://www.gorillawalker.com/introduction-to-pspice-for-electric-circuits-6th-edition.pdf
    • http://www.gorillawalker.com/shekhawati-the-havelis-of-the-merchant-princes.pdf
    • http://www.gorillawalker.com/dye-plants-and-dyeing.pdf
    • http://www.gorillawalker.com/pistachio-salad-recipes-kindle-edition.pdf
    • http://www.gorillawalker.com/wayne-thiebaud-2016-calendar.pdf
    • http://www.gorillawalker.com/one-direction-pop-icons.pdf
    • http://www.gorillawalker.com/milestones-in-strategic-arms-control-1945-2000-united-states-air.pdf
    • http://www.gorillawalker.com/the-little-pie-cookbook.pdf
    • http://www.gorillawalker.com/beginning-and-intermediate-algebra-value-pack-includes-beginning-and-intermediate.pdf
    • http://www.gorillawalker.com/die-beurteilung-des-behandlungserfolges-in-der-psychotherapie-523-acht-bis.pdf
    • http://www.gorillawalker.com/741-764-gemeinschaft-leibrente-spiel-german-edition.pdf
    • http://www.gorillawalker.com/the-beard.pdf
    • http://www.gorillawalker.com/for-those-involved-in-welfare-nursing-and-medical-care-fact.pdf
    • http://www.gorillawalker.com/groovy-map-guide-bangkok-by-night-groovy-map-n-guide.pdf
    • http://www.gorillawalker.com/archaeology-in-practice-a-student-guide-to-archaeological-analyses.pdf
    • http://www.gorillawalker.com/sandro-photography-fashion-portraiture-sports.pdf
    • http://www.gorillawalker.com/never-trust-a-pirate-scandal-at-the-house-of-russell.pdf
    • http://www.gorillawalker.com/queen-of-the-road-the-true-tale-of-47-states.pdf
    • http://www.gorillawalker.com/bickley-11e-text-and-7e-text-package.pdf
    • http://www.gorillawalker.com/bark-baxter-bark-the-literacy-tower.pdf
    • http://www.gorillawalker.com/physik-f-r-wissenschaftler-und-ingenieure-german-edition.pdf
    • http://www.gorillawalker.com/higher-geometry-an-introduction-to-advanced-methods-in-analytic-geometry.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.