Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c6745d3550593d3…

MALICIOUS

PDF

45.9 KB Created: 2018-11-23 20:31:00 +03:00 Authoring application: - (via Acrobat Distiller 5.0.5 (Windows))
MD5: f55f1a032367c91a62dda3faabb05095 SHA-1: 3d811677512111d36b928f3b973f176db0595859 SHA-256: 0c6745d3550593d3772c77487aeca64bae00d5808f6a6ab0fa07e3292fe460aa
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'gorillawalker.com'. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. ClamAV detection and ML classification further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8634

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7227850-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7227850-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/sustainable-energy-opportunities-and-limitations-energy-climate-and-the-environment.pdf
    • http://www.gorillawalker.com/your-baby-has-a-hearing-loss.pdf
    • http://www.gorillawalker.com/amal-s-eid.pdf
    • http://www.gorillawalker.com/imperfect-institutions-possibilities-and-limits-of-reform-economics-cognition-and.pdf
    • http://www.gorillawalker.com/provence-petit-fute.pdf
    • http://www.gorillawalker.com/world-cup-expert-teams.pdf
    • http://www.gorillawalker.com/si-yu-ki-buddhist-records-of-the-western-world-scholar.pdf
    • http://www.gorillawalker.com/calling-down-the-sky-canadian-aboriginal-voices.pdf
    • http://www.gorillawalker.com/oxorn-foote-human-labor-and-birth-5th-fifth-edition-text.pdf
    • http://www.gorillawalker.com/puritanism-transatlantic-perspectives-on-a-seventeenth-century-anglo-american-faith.pdf
    • http://www.gorillawalker.com/no-surrender-my-thirty-year-war-bluejacket-books.pdf
    • http://www.gorillawalker.com/die-weisheit-gottes-wer-sie-sucht-dem-gibt-sie-sich.pdf
    • http://www.gorillawalker.com/phenomenology-of-practice-meaning-giving-methods-in-phenomenological-research-and.pdf
    • http://www.gorillawalker.com/shy-bladder-syndrome-your-step-by-step-guide-to-overcoming.pdf
    • http://www.gorillawalker.com/down-beat-s-yearbook-of-swing.pdf
    • http://www.gorillawalker.com/thrips-naturalists-handbooks.pdf
    • http://www.gorillawalker.com/cycling-in-the-yorkshire-dales.pdf
    • http://www.gorillawalker.com/foxtrot-we-re-on-the-way-san-antonio-texas-police.pdf
    • http://www.gorillawalker.com/historical-dictionary-of-algeria.pdf
    • http://www.gorillawalker.com/knights-of-sidonia-volume-9.pdf
    • http://www.gorillawalker.com/little-britches-father-and-i-were-ranchers-paperback.pdf
    • http://www.gorillawalker.com/autocourse-2015-grand-prix-calendar-contains-dates-for-september-december.pdf
    • http://www.gorillawalker.com/eglr-2009-volume-1.pdf
    • http://www.gorillawalker.com/thich-nhat-hanh-2016-mini-calendar.pdf
    • http://www.gorillawalker.com/a-treatise-on-the-theory-and-practice-of-landscape-gardening.pdf
    • http://www.gorillawalker.com/fantastic-four-611-susan-komen-variant.pdf
    • http://www.gorillawalker.com/the-challenge-of-rural-electrification-strategies-for-developing-countries-rff.pdf
    • http://www.gorillawalker.com/in-the-bight-the-bc-forest-industry-today.pdf
    • http://www.gorillawalker.com/psychology-and-crime-an-introduction-to-criminological-psychology.pdf
    • http://www.gorillawalker.com/rogue-institution-vigilante-injustice-lawlessness-and-disorder-at-the-air.pdf
    • http://www.gorillawalker.com/mccall-s-cooking-school-recipe-card-fish-seafood-21-baked.pdf
    • http://www.gorillawalker.com/programming-bots-spiders-and-intelligent-agents-in-microsoft-visual-c.pdf
    • http://www.gorillawalker.com/good-night-baby-animals-bedtime-stories-collection-excellent-for-beginner.pdf
    • http://www.gorillawalker.com/the-confucian-s-progress-autobiographical-writings-in-traditional-china.pdf
    • http://www.gorillawalker.com/bass-reeves-tales-of-the-talented-tenth-volume-1.pdf
    • http://www.gorillawalker.com/the-vitamin-bible-how-the-right-vitamins-and-nutrient-supplements.pdf
    • http://www.gorillawalker.com/a-case-for-murder-brittany-murphy-files.pdf
    • http://www.gorillawalker.com/des-kaisers-neue-kleider-german-well-loved-tales-german-edition.pdf
    • http://www.gorillawalker.com/big-english-4-student-book.pdf
    • http://www.gorillawalker.com/white-of-snow-an-fairie-tale-extraordinaire.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.