Malicious PDF — malware analysis report

Static analysis result for SHA-256 50a696b6dbbb98c4…

MALICIOUS

PDF

42.3 KB Created: 2019-04-03 18:18:59 +03:00 Authoring application: Adobe InDesign CS6 (Windows) (via Adobe PDF Library 10.0.1)
MD5: c7925051af2e031bda76316ceb405529 SHA-1: 1791d2e07cfa7ded8b5d1ba68086b8a3f2525fd1 SHA-256: 50a696b6dbbb98c4e44b22c8a9aae2a1cae78086f7a43fdcef2ed121eb05e2b6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to other PDF documents, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this as Pdf.Dropper.Agent-7061374-0, and ML classification strongly suggests maliciousness. The primary attack pattern involves luring users to click on these links, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7061374-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7061374-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/high-angular-resolution-in-astrophysics-nato-science-series-c-closed.pdf
    • http://www.gorillawalker.com/how-to-become-your-own-best-infertility-counselor-helping-you.pdf
    • http://www.gorillawalker.com/sharepoint-2013-unleashed-kindle-edition.pdf
    • http://www.gorillawalker.com/acsm-handbook-for-the-team-physician-books.pdf
    • http://www.gorillawalker.com/quickbooks-2010-all-in-one-for-dummies.pdf
    • http://www.gorillawalker.com/economics-of-international-adjustment.pdf
    • http://www.gorillawalker.com/the-gospel-of-the-redman-a-way-of-life.pdf
    • http://www.gorillawalker.com/blood-and-kisses-the-vampire-lovers-book-1.pdf
    • http://www.gorillawalker.com/petr-petrovich-semenov-travels-in-the-tian-shan-1856-1857.pdf
    • http://www.gorillawalker.com/glass-structures.pdf
    • http://www.gorillawalker.com/allen-s-synonyms-and-antonyms-everyday-handbooks-eh-328.pdf
    • http://www.gorillawalker.com/god-s-election-who-shall-lay-anything-to-the-charge.pdf
    • http://www.gorillawalker.com/systematics-of-masdevallia-monographs-in-systemic-botany-msb-16.pdf
    • http://www.gorillawalker.com/principle-centered-leadership-abridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/geology-of-korea-text-for-geological-map-of-korea-1.pdf
    • http://www.gorillawalker.com/oeuvres-de-ren.pdf
    • http://www.gorillawalker.com/dir-seele-des-weltalls-k-429-468a-full-score-a2669.pdf
    • http://www.gorillawalker.com/don-t-worry-he-won-t-get-far-on-foot.pdf
    • http://www.gorillawalker.com/the-shifting-shadows-of-moongate.pdf
    • http://www.gorillawalker.com/new-2015-a-level-chemistry-for-ocr-a-year-2.pdf
    • http://www.gorillawalker.com/annotated-guide-to-the-insolvency-legislation-company-law-books.pdf
    • http://www.gorillawalker.com/handbook-on-decision-support-systems-1-basic-themes-international-handbooks.pdf
    • http://www.gorillawalker.com/revelation-of-jesus-christ-kindle-edition.pdf
    • http://www.gorillawalker.com/web-server-technology.pdf
    • http://www.gorillawalker.com/ace-your-case-vi-mastering-the-case-interview-wetfeet-insider.pdf
    • http://www.gorillawalker.com/world-s-passenger-ships.pdf
    • http://www.gorillawalker.com/percy-bysshe-shelley-poet-and-revolutionary-revolutionary-lives-digital.pdf
    • http://www.gorillawalker.com/under-the-witches-moon-a-romantic-tale-of-mediaeval-rome.pdf
    • http://www.gorillawalker.com/labor-and-employment-law.pdf
    • http://www.gorillawalker.com/wto-institutions-and-dispute-settlement-max-planck-commentaries-on-world.pdf
    • http://www.gorillawalker.com/make-getting-started-with-rfid-identify-objects-in-the-physical.pdf
    • http://www.gorillawalker.com/psychosocial-palliative-care.pdf
    • http://www.gorillawalker.com/truth-in-lending.pdf
    • http://www.gorillawalker.com/the-star-trek-the-starfleet-survival-guide.pdf
    • http://www.gorillawalker.com/more-than-good-intentions-improving-the-ways-the-world-s.pdf
    • http://www.gorillawalker.com/the-hepatology-tcm-odd-square-chinese-edition.pdf
    • http://www.gorillawalker.com/dangerous-river-paperback.pdf
    • http://www.gorillawalker.com/burton-max-oven-to-go-my-17-favorite-recipes.pdf
    • http://www.gorillawalker.com/the-practical-guide-to-drawing-portraits-great-drawing-step-by.pdf
    • http://www.gorillawalker.com/suddenly-i-c-sampler-hit-by-the-lesbian-magic-stick.pdf
    • http://www.gorillawalker.com/economics-of-in
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.