Malicious PDF — malware analysis report

Static analysis result for SHA-256 74b97ffc4159e0d2…

MALICIOUS

PDF

40.9 KB Created: 2018-11-30 20:35:10 +03:00 Authoring application: DVIPSONE 2.2.4 http://www.YandY.com (via Acrobat Distiller 7.0.5 (Windows))
MD5: 89b7e9dcda11bed32873563860c64d04 SHA-1: b93bae768fbff7c902bdd3b58fa3dbf5081e9421 SHA-256: 74b97ffc4159e0d29e66009538da3f614b8faeabfb85f9d98198db5c6d3c0f6a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests the document is designed to distribute or link to a large volume of content, potentially for SEO manipulation or to serve as a distribution point for other malicious files. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8872

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7141955-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7141955-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/aat-personal-tax-fa2014-study-text.pdf
    • http://www.gorillawalker.com/november-hesperus-classics.pdf
    • http://www.gorillawalker.com/nuclear-and-radiochemistry-elsevier-insights.pdf
    • http://www.gorillawalker.com/the-martins-dream-big.pdf
    • http://www.gorillawalker.com/australia-west.pdf
    • http://www.gorillawalker.com/jane-goodall-chimpanzee-expert-activist-history-maker-biographies-abdo.pdf
    • http://www.gorillawalker.com/american-scientist-contains-articles-on-tell-tale-dust-aerial-photography.pdf
    • http://www.gorillawalker.com/it-s-not-about-the-hunter-easy-to-read-wonder.pdf
    • http://www.gorillawalker.com/multiple-regression-and-beyond.pdf
    • http://www.gorillawalker.com/anxiety-disorders-in-children-and-adolescents-cambridge-child-and-adolescent.pdf
    • http://www.gorillawalker.com/hannah-s-ghost-kindle-edition.pdf
    • http://www.gorillawalker.com/tokaido-texts-and-tales-tokaido-gojusan-tsui-by-kuniyoshi-hiroshige.pdf
    • http://www.gorillawalker.com/mel-bay-new-dimensions-in-classical-guitar-for-children.pdf
    • http://www.gorillawalker.com/usar-el-cerebro-conocer-nuestra-mente-para-vivir-mejor-spanish.pdf
    • http://www.gorillawalker.com/best-of-the-beatles-for-cello.pdf
    • http://www.gorillawalker.com/albright-v-teas-u-s-supreme-court-transcript-of-record.pdf
    • http://www.gorillawalker.com/psalms-volume-1-encountering-god-new-community-bible-study-series.pdf
    • http://www.gorillawalker.com/atlas-of-nuclear-medicine-lung-and-heart-v-2.pdf
    • http://www.gorillawalker.com/tlahtolnahuatilli-curso-elemental-de-nahuatl-clasico-en-15-fasciculos-v.pdf
    • http://www.gorillawalker.com/from-italy-with-love-kindle-edition.pdf
    • http://www.gorillawalker.com/hannah-s-first-time-with-the-billionaire-doctor-a-steamy.pdf
    • http://www.gorillawalker.com/memos-from-midlife-24-parables-of-adult-adjustment.pdf
    • http://www.gorillawalker.com/wounded-a-novel.pdf
    • http://www.gorillawalker.com/inspector-calls-teach-yourself-revision-guides.pdf
    • http://www.gorillawalker.com/job-interview-skills.pdf
    • http://www.gorillawalker.com/basics-fashion-design-01-research-and-design-second-edition.pdf
    • http://www.gorillawalker.com/joseph-and-aseneth-guides-to-the-apocrypha-and-pseudepigrap.pdf
    • http://www.gorillawalker.com/unruly-corporatism-associational-life-in-twentieth-century-egypt.pdf
    • http://www.gorillawalker.com/miles-to-go-the-lost-years.pdf
    • http://www.gorillawalker.com/knocked-up-fertile-fun-volume-2-kindle-edition.pdf
    • http://www.gorillawalker.com/quantum-memory-working-magic-with-your-memory.pdf
    • http://www.gorillawalker.com/plowed-and-planted-by-the-ladyboy-kindle-edition.pdf
    • http://www.gorillawalker.com/how-to-teach-your-children-about-sex-without-making-a.pdf
    • http://www.gorillawalker.com/palace-council.pdf
    • http://www.gorillawalker.com/a-first-course-in-probability-9th-edition.pdf
    • http://www.gorillawalker.com/negotiation-and-design-for-the-self-organizing-city-gaming-as.pdf
    • http://www.gorillawalker.com/deity-and-the-sword-naginata-sojutsu-v-3.pdf
    • http://www.gorillawalker.com/bloom-s-major-dramatists-set-26-volumes.pdf
    • http://www.gorillawalker.com/race-and-the-incidence-of-environmental-hazards-a-time-for.pdf
    • http://www.gorillawalker.com/war-crimes-investigation-kindle-edition.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://www.YandY.com
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.