Malicious PDF — malware analysis report

Static analysis result for SHA-256 65ba6a9f0fcedb1a…

MALICIOUS

PDF

32.3 KB Created: 2019-09-18 22:51:38 +03:00 Authoring application: FrameMaker 10.0.2 (via Acrobat Distiller 10.1.15 (Windows))
MD5: b43b8ff53531476d8c36b9547fceb0fa SHA-1: b638a26024a3880d3b55a0d350c86ab4fa339faf SHA-256: 65ba6a9f0fcedb1ab92b66b02fd82e4b6cb71106e07316328175dbe0046d8fb0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a mass external link farm, with 32 links to various PDF files hosted on gorillawalker.com. This heuristic, combined with a high ML classifier score and ClamAV detection, strongly suggests malicious intent. The embedded URLs likely serve as a lure or a method to distribute further malicious content, aligning with a spearphishing attachment attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8529

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7331987-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7331987-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/lady-madonna-sheet-music.pdf
    • http://www.gorillawalker.com/1000-questions-and-answers-about-australia.pdf
    • http://www.gorillawalker.com/50-great-myths-of-human-sexuality.pdf
    • http://www.gorillawalker.com/crime-prevention-through-housing-design.pdf
    • http://www.gorillawalker.com/alcandro-lo-confesso-k-294-full-score-a2970.pdf
    • http://www.gorillawalker.com/2010-madison-wi-city-wall-maps.pdf
    • http://www.gorillawalker.com/plumbing-venting-decoding-chapter-9-of-the-ipc.pdf
    • http://www.gorillawalker.com/interfaith-just-peacemaking-jewish-christian-and-muslim-perspectives-on-the.pdf
    • http://www.gorillawalker.com/scarf-shal-gardan-persian-edition.pdf
    • http://www.gorillawalker.com/2009-u-s-bankruptcy-code-rules-booklet.pdf
    • http://www.gorillawalker.com/niv-bible-student-large-print-151-summer-2015-standard-lesson.pdf
    • http://www.gorillawalker.com/follow-the-wind-the-spanish-bit-saga-spanish-bit-saga.pdf
    • http://www.gorillawalker.com/strategies-of-a-fantasy-baseball-champ.pdf
    • http://www.gorillawalker.com/diplomacy-and-security-community-building-eu-crisis-management-in-the.pdf
    • http://www.gorillawalker.com/old-time-fiddler-s-repertory-historic-field-recordings-of-forty.pdf
    • http://www.gorillawalker.com/funny-fish-coloring-book-for-kids-fish-patterns-for-coloring.pdf
    • http://www.gorillawalker.com/pete-the-cat-the-wheels-on-the-bus.pdf
    • http://www.gorillawalker.com/the-girl-s-book-of-enchantments-everyday-magic-for-modern.pdf
    • http://www.gorillawalker.com/philosophy-in-the-islamic-world-a-very-short-introduction-very.pdf
    • http://www.gorillawalker.com/crisis-on-infinite-earths-30th-anniversary-deluxe-edition.pdf
    • http://www.gorillawalker.com/what-was-once-east-pakistan.pdf
    • http://www.gorillawalker.com/aeronautical-radio-communication-systems-and-networks.pdf
    • http://www.gorillawalker.com/diario-di-casoli-versiguasti-vol-2-italian-edition.pdf
    • http://www.gorillawalker.com/brain-gym-teacher-s-edition.pdf
    • http://www.gorillawalker.com/the-kindness-diaries-one-man-s-quest-to-ignite-goodwill.pdf
    • http://www.gorillawalker.com/keeping-literary-company-working-with-writers-since-the-sixties.pdf
    • http://www.gorillawalker.com/the-hunting.pdf
    • http://www.gorillawalker.com/the-anniversary-present-toys-and-bondage-for-my-si-a.pdf
    • http://www.gorillawalker.com/ninchikagaku-de-wasurenai-toeic-happyakuten-hissuno-yonsengo-kanzen-masuta-japanese.pdf
    • http://www.gorillawalker.com/clutter-free-3-book-bundle-step-by-step-plans-for.pdf
    • http://www.gorillawalker.com/text-and-act-essays-on-music-and-performance.pdf
    • http://www.gorillawalker.com/mastering-perl.pdf
    • http://www.gorillawalker.com/special-words.pdf
    • http://www.gorillawalker.com/supergirl-way-of-the-world.pdf
    • http://www.gorillawalker.com/johannes-kepler-and-the-new-astronomy-oxford-portraits-in-science.pdf
    • http://www.gorillawalker.com/speech-and-harm-controversies-over-free-speech.pdf
    • http://www.gorillawalker.com/guiding-readers-through-text-strategy-guides-for-new-times.pdf
    • http://www.gorillawalker.com/guide-to-human-performance-measurements-aiaa-standards.pdf
    • http://www.gorillawalker.com/the-warming-kindle-edition.pdf
    • http://www.gorillawalker.com/foundations-of-geometry-2nd-edition-featured-titles-for-geometry.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.