Pdf.Dropper.Agent — PDF malware analysis

Static analysis result for SHA-256 158f7a68c272e122…

MALICIOUS

PDF

38.0 KB Authoring application: OpenOffice.org
MD5: 7a3b17dcf40ab658070193d07f00c1f5 SHA-1: c5c29796f043b2e50b5cf077a103237fec9e92bf SHA-256: 158f7a68c272e122049f267fc2611eda05488bc3969a645a4623d30dc2acc6c4
160 Risk Score

Malware Insights

Pdf.Dropper.Agent · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with multiple URLs pointing to PDF files, indicating a likely distribution mechanism for malware. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Dropper.Agent-7846713-0' strongly suggest this file is a dropper. The presence of a 'download button' lure further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7846713-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7846713-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://store.themovementdr.net/uploads/1/3/0/5/130543671/xokev_zexule_zikizuxekid_kuvomejuwekokel.pdf
    • http://wikeziweka.vkbonus.fun/uploads/2020/01/27/sulija.pdf
    • http://nejaxu.lifetime24.ru/uploads/2020/01/27/bb890cdfde673d.pdf
    • http://zilisrep.com/uploads/1/3/0/4/130478307/didaz-lumubofov.pdf
    • http://fasezegeki.adwords-campagnes.com/uploads/2020/01/29/9951147.pdf
    • http://arctictreasures.shop/uploads/1/3/0/6/130603989/riselutawo-zowureses-milafid-xaxixaraf.pdf
    • https://tewavirimedox.weebly.com/uploads/1/3/0/5/130539846/gelodexulexipe.pdf
    • https://tixogapoz.weebly.com/uploads/1/3/0/5/130588948/vuvileja-sebuso-polisogi.pdf
    • http://krismgabriel.com/uploads/1/3/0/6/130603969/7946934.pdf
    • http://mermaidicamusic.com/uploads/1/3/0/5/130550880/130550880.html#kundli+software+free++for+windows+8.+1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012b1.bin
44c03d54f6dc99902ad64539a0c8f8af698b34187b560fbe9ad67a09d1646fb6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B1 8488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.