Malicious PDF — malware analysis report

Static analysis result for SHA-256 01c39ff4d8b33aed…

MALICIOUS

PDF

44.1 KB Created: 2018-12-15 08:52:55 +03:00 Authoring application: Acrobat PDFMaker 11 for Word (via Adobe PDF Library 11.0)
MD5: a09f8404831c53c00894929e45f31031 SHA-1: 2e35a2c1ba5e68dabaaaa6a61b5b268c07974020 SHA-256: 01c39ff4d8b33aed54da4fde7218954549c8a5fa1fdc53b4a9c3b7f069577eb8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a behavior flagged by the PDF_SEO_LINK_FARM heuristic. This suggests the document's primary purpose is to act as a link farm, potentially for SEO manipulation or to distribute further malicious content. ClamAV also identified it as Pdf.Dropper.Agent-7222269-0, indicating a known malicious pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9016

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7222269-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7222269-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/what-foreigners-need-to-know-about-america-from-a-to.pdf
    • http://www.gorillawalker.com/10-christmas-brownie-mix-recipes-holiday-recipes-anyone-can-make.pdf
    • http://www.gorillawalker.com/fakebook-improvisations-on-a-journey-back-to-jazz.pdf
    • http://www.gorillawalker.com/bundle-human-relations-4th-coursemate-printed-access-card.pdf
    • http://www.gorillawalker.com/finite-mathematics-its-applications-hunter-college-edition.pdf
    • http://www.gorillawalker.com/jason-rhoades-collector-s-choice-vol-9-collector-s-choice.pdf
    • http://www.gorillawalker.com/precision-landmark-location-for-machine-vision-and-photogrammetry.pdf
    • http://www.gorillawalker.com/history-of-broughton-place-united-presbyterian-church-with-sketches-of.pdf
    • http://www.gorillawalker.com/medical-terminology-essentials.pdf
    • http://www.gorillawalker.com/the-jaguar-xk-series-crowood-autoclassics.pdf
    • http://www.gorillawalker.com/step-by-step-guide-to-microwave-cooking-basics-microwave-cooking.pdf
    • http://www.gorillawalker.com/matteson-mcconnell-s-gerontological-nursing-text-and-e-book-package.pdf
    • http://www.gorillawalker.com/the-arthur-of-the-welsh-the-arthurian-legend-in-medieval.pdf
    • http://www.gorillawalker.com/the-stardust-road-sometimes-i-wonder-the-autobiography-of-hoagy.pdf
    • http://www.gorillawalker.com/report-of-the-consultation-on-management-of-fishing-capacity-shark.pdf
    • http://www.gorillawalker.com/my-first-book-of-cowboy-songs-dover-music-for-piano.pdf
    • http://www.gorillawalker.com/analysis-and-control-of-oilwell-drilling-vibrations-a-time-delay.pdf
    • http://www.gorillawalker.com/whispers-of-moonlight-rocky-mountain-memories-book-2.pdf
    • http://www.gorillawalker.com/bio-dynamics-number-82-summer-1967-a-periodical-furthering-soil.pdf
    • http://www.gorillawalker.com/when-cultures-meet-national-geographic-reading-expeditions-language-literacy-vocabulary.pdf
    • http://www.gorillawalker.com/property-insurance-law-and-claims.pdf
    • http://www.gorillawalker.com/biologically-inspired-design-computational-methods-and-tools.pdf
    • http://www.gorillawalker.com/with-all-its-faults-a-candid-account-of-forty-years.pdf
    • http://www.gorillawalker.com/cycling-the-kettle-valley-railway.pdf
    • http://www.gorillawalker.com/the-egyptian-book-of-the-dead-penguin-classics.pdf
    • http://www.gorillawalker.com/ap-latin-vergil-and-literature-exams-w-cd-rom-rea.pdf
    • http://www.gorillawalker.com/introduction-to-the-organization-of-information-kindle-edition.pdf
    • http://www.gorillawalker.com/freedom-from-stress-a-holistic-approach.pdf
    • http://www.gorillawalker.com/puzzles-for-you-on-your-birthday-15th-june.pdf
    • http://www.gorillawalker.com/the-final-addendum.pdf
    • http://www.gorillawalker.com/entering-grade-1-camp-step-ahead-workbooks.pdf
    • http://www.gorillawalker.com/hamlet-s-absent-father-princeton-legacy-library.pdf
    • http://www.gorillawalker.com/critical-pedagogy-primer-peter-lang-primer-english-and-english-edition.pdf
    • http://www.gorillawalker.com/gestalt-terapia-com-crian.pdf
    • http://www.gorillawalker.com/slave-to-a-vampire-paranormal-erotic-romance-involving-submissive-female.pdf
    • http://www.gorillawalker.com/conflict-of-religions-in-the-early-roman-empire.pdf
    • http://www.gorillawalker.com/suicide-and-attempted-suicide-methods-and-consequences.pdf
    • http://www.gorillawalker.com/macular-disorders-an-illustrated-diagnostic-guide-1e.pdf
    • http://www.gorillawalker.com/sacred-rhythms-arranging-our-lives-for-spiritual-transformation.pdf
    • http://www.gorillawalker.com/best-hikes-with-dogs-oregon.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.