Malicious PDF — malware analysis report

Static analysis result for SHA-256 e36d56fdd9c814b2…

MALICIOUS

PDF

33.1 KB Created: 2019-05-24 00:42:19 +03:00 Authoring application: calibre 0.9.36 [http://calibre-ebook.com]
MD5: 8a952e1d5fb4e194c3651d5833f96dde SHA-1: 0ffdf1a4c6d9dde5cad1d134a6c4b30371b93b00 SHA-256: e36d56fdd9c814b27cb4f16f60b2775e65cde5a82a8ad1066fa37d204748b87f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to drive traffic to a collection of potentially malicious or misleading documents. The ML classifier also flagged the document as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8313

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/day-trade-like-a-pro-more-trades-more-profit-lose.pdf
    • http://www.gorillawalker.com/what-s-bugging-you-a-fond-look-at-the-animals.pdf
    • http://www.gorillawalker.com/palladium-in-heterocyclic-chemistry-volume-20-a-guide-for-the.pdf
    • http://www.gorillawalker.com/the-financial-crisis-of-our-time-financial-management-association-survey.pdf
    • http://www.gorillawalker.com/jar-of-fools-part-one.pdf
    • http://www.gorillawalker.com/end-time-believer-s-bible.pdf
    • http://www.gorillawalker.com/theory-of-algebraic-integers-cambridge-mathematical-library.pdf
    • http://www.gorillawalker.com/evidence-cases-and-materials-american-casebooks.pdf
    • http://www.gorillawalker.com/lafcadio-hearn-s-creole-cookbook.pdf
    • http://www.gorillawalker.com/harem-rumble-episode-2-beauty-and-shadow.pdf
    • http://www.gorillawalker.com/wheat-flour-milling.pdf
    • http://www.gorillawalker.com/trust-your-gut-heal-from-ibs-and-other-chronic-stomach.pdf
    • http://www.gorillawalker.com/soft-deliveries-a-century-of-cricket-years.pdf
    • http://www.gorillawalker.com/no-regrets-no-apologies.pdf
    • http://www.gorillawalker.com/the-life-cycle-of-fish-life-cycles.pdf
    • http://www.gorillawalker.com/farther-away-essays.pdf
    • http://www.gorillawalker.com/great-mystery-women-titles-tape-measure-murder-easter-devil-scrawn.pdf
    • http://www.gorillawalker.com/the-imperial-messenger-thomas-friedman-at-work-counterblasts.pdf
    • http://www.gorillawalker.com/traditional-distillation-art-passion-hardcover.pdf
    • http://www.gorillawalker.com/tokyo-city-on-the-edge.pdf
    • http://www.gorillawalker.com/little-black-book-of-rome-the-timeless-guide-to-the.pdf
    • http://www.gorillawalker.com/destroying-my-best-friend-s-daughter.pdf
    • http://www.gorillawalker.com/martha-stewart-s-cupcakes-175-inspired-ideas-for-everyone-s.pdf
    • http://www.gorillawalker.com/the-analysis-and-cognition-of-basic-melodic-structures-the-implication.pdf
    • http://www.gorillawalker.com/ballads-of-a-cheechako-first-edition.pdf
    • http://www.gorillawalker.com/a-resource-for-korean-grammar-instruction-klear-textbooks-in-korean.pdf
    • http://www.gorillawalker.com/fireman-of-desire-2.pdf
    • http://www.gorillawalker.com/mountain-climbing-2016-square-12x12-multilingual-edition.pdf
    • http://www.gorillawalker.com/performance-favorites-volume-1-bassoon.pdf
    • http://www.gorillawalker.com/minnesota-vikings-insider-s-guide-to-pro-football-nfc-north.pdf
    • http://www.gorillawalker.com/biosynthesis-and-its-control-in-plants-annual-proceedings-of-the.pdf
    • http://www.gorillawalker.com/the-funny-pages-1-473-jokes-from-today-s-funniest.pdf
    • http://www.gorillawalker.com/rosa-blanca-white-rose-rose-blanche-spanish-edition.pdf
    • http://www.gorillawalker.com/cairo-and-its-environs.pdf
    • http://www.gorillawalker.com/the-art-of-writing-speaking-the-english-language-v-1.pdf
    • http://www.gorillawalker.com/theban-plays-hackett-classics.pdf
    • http://www.gorillawalker.com/tongue-in-cheek.pdf
    • http://www.gorillawalker.com/masters-of-russian-impressionism-sergei-petrovich-tkachev-aleksei-petrovich-tkachev.pdf
    • http://www.gorillawalker.com/the-complete-book-of-nature-crafts-how-to-make-wreaths.pdf
    • http://www.gorillawalker.com/power-hold-em-strategy.pdf
    • http://www.gorill
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://calibre-ebook.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    +1 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.