Malicious PDF — malware analysis report

Static analysis result for SHA-256 791b8a4304721e15…

MALICIOUS

PDF

44.1 KB Created: 2018-11-23 08:00:48 +03:00 Authoring application: BookVirtual Digital Works (via BookVirtual Corp. Patents Pending.)
MD5: 02e07eba140def3c745f852031d122ef SHA-1: fdb8ecba72db26657c22ff2427fcec3f8069ebdc SHA-256: 791b8a4304721e154bd8b527e6eb12c296633118bba31280cf294d12fc8e1575
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this as Pdf.Dropper.Agent, and an ML classifier also flagged it as malicious. The embedded URLs suggest a link farm attack pattern, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9171

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7274841-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7274841-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/desiring-women-the-partnership-of-virginia-woolf-and-vita-sackville.pdf
    • http://www.gorillawalker.com/family-medical-health-guide-consumer-guide-magazine-march-1985.pdf
    • http://www.gorillawalker.com/bankruptcy-law-manual-the-practitioner-s-guide-fifth-edition-2.pdf
    • http://www.gorillawalker.com/how-i-stopped-worrying-about-retirement-without-alcohol-nicotine-caffeine.pdf
    • http://www.gorillawalker.com/serving-up-faith-recipes-cooking-tips-inspirational-stories.pdf
    • http://www.gorillawalker.com/un-saco-de-canicas-a-sack-of-marbles-spanish-edition.pdf
    • http://www.gorillawalker.com/chilton-s-automatic-transmission-repair-1980-1984-domestic-vehicles.pdf
    • http://www.gorillawalker.com/spinifex-baby.pdf
    • http://www.gorillawalker.com/three-little-horses.pdf
    • http://www.gorillawalker.com/the-collapse-of-the-german-war-economy-1944-1945-allied.pdf
    • http://www.gorillawalker.com/answers-to-catholic-claims.pdf
    • http://www.gorillawalker.com/butler-s-big-dance-the-team-the-tournament-and-basketball.pdf
    • http://www.gorillawalker.com/muslim-non-muslim-marriage-political-and-cultural-contestations-in-southeast.pdf
    • http://www.gorillawalker.com/bunny-eats-lunch-hello-genius.pdf
    • http://www.gorillawalker.com/alger.pdf
    • http://www.gorillawalker.com/history-in-the-present-tense-engaging-students-through-inquiry-and.pdf
    • http://www.gorillawalker.com/envisioning-the-future-science-fiction-and-the-next-millennium.pdf
    • http://www.gorillawalker.com/the-adolfo-stahl-lectures-in-astronomy-delivered-in-san-francisco.pdf
    • http://www.gorillawalker.com/dominguez-escalante-journal-their-expedition-through-colorado-utah-arizona-and.pdf
    • http://www.gorillawalker.com/master-of-desire.pdf
    • http://www.gorillawalker.com/the-juice-detox-diet-3-book-collection.pdf
    • http://www.gorillawalker.com/aanvil-corset-the-spells-and-stockings-series-book-1-trans.pdf
    • http://www.gorillawalker.com/singapore-our-world-in-colour.pdf
    • http://www.gorillawalker.com/amazing-water-inside-science-readers-inside-science-physical-science.pdf
    • http://www.gorillawalker.com/pollution-writing-the-critical-essay.pdf
    • http://www.gorillawalker.com/ultimate-encyclopedia-of-beer-the-definitive-guide-to-the-world.pdf
    • http://www.gorillawalker.com/wild-courage-a-dark-gay-erotica-thriller-from-the-ashes.pdf
    • http://www.gorillawalker.com/orph-e-aux-enfers-an-opera-in-four-acts-vocal.pdf
    • http://www.gorillawalker.com/the-communion-service-a-guide-your-local-church.pdf
    • http://www.gorillawalker.com/drones-and-the-ethics-of-targeted-killing.pdf
    • http://www.gorillawalker.com/porsche-calendar-2015-wall-calendars-car-calendar-automobile-calendar-monthly.pdf
    • http://www.gorillawalker.com/la-joven-del-jard-n-romance-hist-rico-spanish-edition.pdf
    • http://www.gorillawalker.com/freemasonry-in-black-and-white.pdf
    • http://www.gorillawalker.com/human-computer-interaction-fundamentals-human-factors-and-ergonomics.pdf
    • http://www.gorillawalker.com/mis-documentos-narrativas-hispanicas-spanish-edition.pdf
    • http://www.gorillawalker.com/my-travel-journal-summer-abstract-background-travel-planner-journal-6.pdf
    • http://www.gorillawalker.com/el-diario-de-un-c.pdf
    • http://www.gorillawalker.com/futanari-housewife-futa-on-female-transformation-erotica-kindle-edition.pdf
    • http://www.gorillawalker.com/the-chemical-analysis-of-human-breath-a-means-to-assess.pdf
    • http://www.gorillawalker.com/otitis-media-in-infants-and-children.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.