Pdf.Dropper.Agent — PDF malware analysis

Static analysis result for SHA-256 16c61f42dcc3ba06…

MALICIOUS

PDF

18.7 KB Created: 2020-03-18 17:50:13 +00:00 Authoring application: mPDF 5.7
MD5: efa000de85071475c3b1cc05fbb27acb SHA-1: dd98b56c37f82687f44b905e3369b5eda25aea3c SHA-256: 16c61f42dcc3ba06b1adddaa1c456b61b6e9820b679a2b7972202c9331f3ef68
102 Risk Score

Malware Insights

Pdf.Dropper.Agent · confidence 95%

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating it is likely a dropper. The document body contains multiple embedded URLs, one of which is also flagged as an external URI, suggesting the PDF's purpose is to redirect the user to download a secondary payload. The presence of a visual download button heuristic further supports the lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9912

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-8901344-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-8901344-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ujcsiniio.myhome.cx/7cd1cd3cd0cd2cd6/Joe-Beauchemin-s-Storyteller-Tales-by-Joseph-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/1cd1cd8cd8cd2cd0cd3/Pl-tzchen-Kekse-Cookies-und-Makronen-St-ck-f-r-St-ck-ein-St-ckchen-Gl-ck-by-Lee-Currie.pdf
    • http://ujcsiniio.myhome.cx/5cd0cd0cd4cd7cd7/Serving-HIM-Vol-5-Serving-HIM-5-by-M-S-Parker.pdf
    • http://ujcsiniio.myhome.cx/4cd0cd9cd6cd9cd9/Serving-HIM-Vol-1-Serving-HIM-1-by-M-S-Parker.pdf
    • http://ujcsiniio.myhome.cx/9cd6cd4cd3cd2cd3/Stuck-with-a-Schmuck-Stuck-with-a-0-5-by-D-D-Scott.pdf
    • http://ujcsiniio.myhome.cx/1cd1cd5cd8cd8cd2cd2/Erst-ich-ein-St-ck-dann-du---3-Monstergeschichten-Themenband-12-Erst-ich-ein-St-ck-by-Patricia-Schr-der.pdf
    • http://ujcsiniio.myhome.cx/7cd8cd5cd2cd7cd7/Blair-s-Chronological-and-Historical-Tables-from-the-Creation-to-the-Present-Time-With-Additions-and-Corrections-from-the-Most-Authentic-Writers-Including-the-Computation-of-St-Paul-as-Connecting-the-Period-from-the-Exode-to-the-Temple-by-John-Blair.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd2cd4/The-Second-Fiddle-by-Yves-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd7cd4/Everything-I-Own-First-Fictions-Series-by-Raymond-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd8cd1/Inside-Image-SQL-by-Denys-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd8cd6/The-Body-in-the-Bushes-by-Joseph-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd4cd1/Turkana-Boy-by-Jean-Fran-ois-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd7cd3/Le-jardinier-et-l-empereur-by-Alain-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd8cd8/Metastasis-of-Colorectal-Cancer-14-by-Nicole-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd5cd0/Sample-Introduction-Systems-in-Icp-MS-and-Icp-Oes-by-Diane-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd6cd6/Counter-Zombie-Warfare-by-Jason-A-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd3cd6/A-Developer-s-Guide-to-SQL-Server-2005-by-Bob-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd1cd2cd6/Odd-Jobs-2-Solomon-s-Code-by-Jason-A-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/7cd1cd3cd0cd4cd5/The-Accidental-Education-of-Jerome-Lupien-by-Yves-Beauchemin.pdf
    • http://ujcsiniio.myhome.cx/9cd9cd5cd0cd6cd4/Craving-HIM-Serving-HIM-7-by-M-S-Parker.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.