Malicious PDF — malware analysis report

Static analysis result for SHA-256 71d9e0a5dcdb43b3…

MALICIOUS

PDF

42.2 KB Created: 2018-12-15 20:11:18 +03:00 Authoring application: FrameMaker 9.0 (via Acrobat Distiller 8.0.0 (Windows))
MD5: 1241c8030f3a4106c3e4776d3389d5dc SHA-1: 39c74e14c29b13052fe531a56ed6f84a52ac49fe SHA-256: 71d9e0a5dcdb43b3f284ab510585843bd6ec1c8beac831d22a29b4bc25009dbd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. While no scripts were explicitly extracted, the nature of the embedded links and the ML classifier's output suggest a malicious intent, possibly to distribute further malware or engage in SEO spam. The ClamAV detection of Pdf.Dropper.Agent-7142887-0 further supports its malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9181

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7142887-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7142887-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/mastering-the-world-of-psychology-books-a-la-carte-plus.pdf
    • http://www.gorillawalker.com/bonsai-theory-of-church-growth.pdf
    • http://www.gorillawalker.com/the-new-path-to-real-estate-wealth-earning-without-owning.pdf
    • http://www.gorillawalker.com/review-questions-and-answers-for-dental-assisting-text-and-e.pdf
    • http://www.gorillawalker.com/the-world-s-best-tropical-dive-destinations.pdf
    • http://www.gorillawalker.com/bee-garden-how-to-create-or-adapt-a-garden-that.pdf
    • http://www.gorillawalker.com/pearls-before-swine-2014-wall-calendar.pdf
    • http://www.gorillawalker.com/derecho-y-poder-la-cuestion-de-la-tierra-y-los.pdf
    • http://www.gorillawalker.com/formulating-research-methods-for-information-systems-volume-1.pdf
    • http://www.gorillawalker.com/a-to-z-street-plan-of-bath-1m-6.pdf
    • http://www.gorillawalker.com/self-theories-their-role-in-motivation-personality-and-development-essays.pdf
    • http://www.gorillawalker.com/afrikakorps-in-action-weapons-no-4.pdf
    • http://www.gorillawalker.com/inglorious-disarray-europe-israel-and-the-palestinians-since-1967.pdf
    • http://www.gorillawalker.com/problems-and-solutions-in-mathematical-finance-stochastic-calculus-1-the.pdf
    • http://www.gorillawalker.com/linux-learn-linux-in-5-days-and-level-up-your.pdf
    • http://www.gorillawalker.com/offshore-wind-energy-in-the-u-s-development-strategy-and.pdf
    • http://www.gorillawalker.com/tess-of-the-d-urbervilles-play-oxford-playscripts.pdf
    • http://www.gorillawalker.com/denominationalism-illustrated-and-explained.pdf
    • http://www.gorillawalker.com/west-of-bliss-hannah-garvey-mysteries-4.pdf
    • http://www.gorillawalker.com/through-the-telescope-a-guide-for-the-amateur-astronomer-revised.pdf
    • http://www.gorillawalker.com/south-park-annual-2013.pdf
    • http://www.gorillawalker.com/in-progress-see-inside-a-lettering-artist-s-sketchbook-and.pdf
    • http://www.gorillawalker.com/mischievous-men-graphic-sexual-scenes-of-gay-sex-motorcycles-and.pdf
    • http://www.gorillawalker.com/atlas-of-temporal-bone-surgery.pdf
    • http://www.gorillawalker.com/big-book-of-camper-van-big-books.pdf
    • http://www.gorillawalker.com/why-programs-fail-a-guide-to-systematic-debugging.pdf
    • http://www.gorillawalker.com/fashion-retailing.pdf
    • http://www.gorillawalker.com/caddie-woodlawn-unabridged-audible-audio-edition.pdf
    • http://www.gorillawalker.com/highlights-favorite-hidden-pictures-wildlife-puzzles.pdf
    • http://www.gorillawalker.com/raspberry-pi-a-beginners-guide-with-over-20-projects-for.pdf
    • http://www.gorillawalker.com/the-everything-no-trans-fats-cookbook-from-store-shelves-to.pdf
    • http://www.gorillawalker.com/i-believe-exploring-the-apostles-creed.pdf
    • http://www.gorillawalker.com/crossing-boundaries-traditions-and-transformations-in-law-and-society-research.pdf
    • http://www.gorillawalker.com/math-in-focus-singapore-math-student-edition-book-a-part.pdf
    • http://www.gorillawalker.com/environmental-politics-and-policy-environmental-politics-policy.pdf
    • http://www.gorillawalker.com/from-front-office-to-front-line-essential-issues-for-health.pdf
    • http://www.gorillawalker.com/illustrated-textbook-of-obstetrics.pdf
    • http://www.gorillawalker.com/loose-girl.pdf
    • http://www.gorillawalker.com/bob-bob-the-builder-simon-schuster-board-books.pdf
    • http://www.gorillawalker.com/the-life-of-elijah.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.