Malicious PDF — malware analysis report

Static analysis result for SHA-256 74bcf6dcb51550ed…

MALICIOUS

PDF

35.1 KB Created: 2019-05-24 00:41:56 +03:00 Authoring application: dvips(k) 5.96 Copyright 2005 Radical Eye Software (via GPL Ghostscript 8.57)
MD5: 75fccbbfd87f2ae94c43036d4a92f560 SHA-1: 3d7f8ae7a5e02649adef4e6e6d1d8ee058c78a0d SHA-256: 74bcf6dcb51550edd9208e7cc40766ccf0bd645c6b7cbaaad0908e86326104de
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files on the same domain. This suggests the document's primary purpose is to act as a link farm, potentially for SEO manipulation or to distribute a large volume of content. The ML classifier also flagged the PDF as malicious, and ClamAV detected it as a dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8018

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7574407-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7574407-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/luke-the-historian-in-the-light-of-research-kindle-edition.pdf
    • http://www.gorillawalker.com/cocina-mediterranea.pdf
    • http://www.gorillawalker.com/mighty-man-manual-victory-and-freedom-from-lust-pornographic-and.pdf
    • http://www.gorillawalker.com/arduino-heat-transfer-science-fair-projects.pdf
    • http://www.gorillawalker.com/avenger-a-halflings-novel.pdf
    • http://www.gorillawalker.com/the-poetics-of-disguise-the-autobiography-of-the-work-in.pdf
    • http://www.gorillawalker.com/my-practical-wing-chun-tao-the-book-of-siu-nim.pdf
    • http://www.gorillawalker.com/keep-your-college-daughter-safe-ways-college-women-can-prevent.pdf
    • http://www.gorillawalker.com/the-communist-party-of-the-united-states-from-the-depression.pdf
    • http://www.gorillawalker.com/birdless-summer.pdf
    • http://www.gorillawalker.com/building-structural-equation-models-in-social-science-kindle-edition.pdf
    • http://www.gorillawalker.com/no-urgency-ceo-a-hi-tech-book-in-modern-time.pdf
    • http://www.gorillawalker.com/accounting-for-horror-post-genocide-debates-in-rwanda.pdf
    • http://www.gorillawalker.com/a-critical-exposition-of-the-philosophy-of-leibniz-with-an.pdf
    • http://www.gorillawalker.com/who-let-the-cat-out-mutts-no-10-mutts-comics.pdf
    • http://www.gorillawalker.com/change-in-eastern-europe.pdf
    • http://www.gorillawalker.com/waggoner-cruising-guide-2012-the-complete-boating-reference.pdf
    • http://www.gorillawalker.com/homemade-facial-masks-101-all-natural-skin-care-recipes-paperback.pdf
    • http://www.gorillawalker.com/diabetes-ready-reference-for-nurse-practitioners-clear-concise-guidelines-for.pdf
    • http://www.gorillawalker.com/fluorescence-spectroscopy-imaging-and-probes.pdf
    • http://www.gorillawalker.com/a-practical-grammar-of-the-swedish-language-with-reading-and.pdf
    • http://www.gorillawalker.com/thoughts-on-machiavelli.pdf
    • http://www.gorillawalker.com/second-chance-paperback.pdf
    • http://www.gorillawalker.com/smart-medicine-for-your-eyes-a-guide-to-safe-and.pdf
    • http://www.gorillawalker.com/autocad-2012-and-autocad-lt-2012-essentials.pdf
    • http://www.gorillawalker.com/all-sports-stories-soccer-titles-trading-goals-lorimer-sports-stories.pdf
    • http://www.gorillawalker.com/the-debt-hucow-s-first-time-hucow-menage-erotica-taking.pdf
    • http://www.gorillawalker.com/anna-freud-the-dream-of-psychoanalysis.pdf
    • http://www.gorillawalker.com/pre-ged-skill-books-student-edition-language-arts-reading-understanding.pdf
    • http://www.gorillawalker.com/the-cat-who-dropped-a-bombshell.pdf
    • http://www.gorillawalker.com/bernard-lamotte-oil-painting-and-brush-painting.pdf
    • http://www.gorillawalker.com/luxury-sales-force-management-strategies-for-winning-over-your-brand.pdf
    • http://www.gorillawalker.com/gesammelte-streichholzbriefe.pdf
    • http://www.gorillawalker.com/fretboard-chord-charts-for-guitar.pdf
    • http://www.gorillawalker.com/resist-or-serve-official-guide-to-the-x-flies-vol.pdf
    • http://www.gorillawalker.com/biology-student-book-1-collins-aqa-a-level-science.pdf
    • http://www.gorillawalker.com/enemies-on-the-couch-a-psychopolitical-journey-through-war-and.pdf
    • http://www.gorillawalker.com/reluctant-cosmopolitans-the-portuguese-jews-of-seventeenth-century-amsterdam.pdf
    • http://www.gorillawalker.com/fighting-drug-abuse-with-acupuncture-the-treatment-that-works.pdf
    • http://www.gorillawalker.com/the-giant-handbook-of-electronic-circuits.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.