Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a0eedd6b1e7f0e4…

MALICIOUS

PDF

43.5 KB Created: 2018-11-30 20:31:42 +03:00 Authoring application: PScript5.dll Version 5.2 (via Acrobat Distiller 7.0.5 (Windows))
MD5: 9f1d5906b23d93ef7e5270be773ad7f4 SHA-1: a976921526c1a43afbe59277cd1662e90ee4abfb SHA-256: 7a0eedd6b1e7f0e456eddad6e052b78bcd4d18be4b3c7942525acd233a537aef
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files on the same domain, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. This suggests the document's primary purpose is to act as a gateway to a link farm, likely for SEO manipulation or to distribute further malicious content. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8859

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7275175-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7275175-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/before-the-ironclad-warship-design-and-development-1815-1860.pdf
    • http://www.gorillawalker.com/sonatina-clarinet-piano.pdf
    • http://www.gorillawalker.com/stock-market-for-beginners-book-stock-market-basics-explained-for.pdf
    • http://www.gorillawalker.com/lay-low-and-don-t-make-the-big-mistake.pdf
    • http://www.gorillawalker.com/circuit-analysis-theory-and-practice-conventional-flow.pdf
    • http://www.gorillawalker.com/the-chelsea-green-reader-selections-from-30-years-of-independent.pdf
    • http://www.gorillawalker.com/the-s-ance.pdf
    • http://www.gorillawalker.com/hot-button-e-mail-copywriting-how-to-write-e-mails.pdf
    • http://www.gorillawalker.com/caloric-consumption-and-the-female-athletic-triad-disordered-eating-amenorrhea.pdf
    • http://www.gorillawalker.com/theodore-presser-flute-102-mastering-the-basics.pdf
    • http://www.gorillawalker.com/making-out-6-what-zoey-saw-making-out-avon-paperback.pdf
    • http://www.gorillawalker.com/goosebumps-monster-edition-2-night-of-the-living-dummy-night.pdf
    • http://www.gorillawalker.com/tief-w-nsche-bdsm-erotik-m-nnliche-dominierung-weibliche-unterwerfung.pdf
    • http://www.gorillawalker.com/betty-crocker-s-cooking-calendar-a-year-round-guide-to.pdf
    • http://www.gorillawalker.com/stranger-in-town-impressions-of-toledo.pdf
    • http://www.gorillawalker.com/bidrag-til-den-danske-civilproces-volume-1-danish-edition.pdf
    • http://www.gorillawalker.com/we-all-giggled-a-bourgeois-family-memoir-life-writing.pdf
    • http://www.gorillawalker.com/historia-universal-2-universal-history-2-del-absolutismo-a-la.pdf
    • http://www.gorillawalker.com/rotary-cement-kiln-2nd-ed.pdf
    • http://www.gorillawalker.com/this-house-on-fire-the-story-of-the-blues.pdf
    • http://www.gorillawalker.com/brontosaurus.pdf
    • http://www.gorillawalker.com/learn-c-for-game-development.pdf
    • http://www.gorillawalker.com/abandoned-america-s-vanishing-landscape.pdf
    • http://www.gorillawalker.com/social-discredit-anti-semitism-social-credit-and-the-jewish-response.pdf
    • http://www.gorillawalker.com/amos-obadiah-thru-the-bible.pdf
    • http://www.gorillawalker.com/manual-completo-de-los-verbos-en-ingles-complete-handbook-of.pdf
    • http://www.gorillawalker.com/while-america-sleeps-an-fbi-whistleblower-s-story.pdf
    • http://www.gorillawalker.com/exploring-the-pastoral-epistles-john-phillips-commentary-series-the-john.pdf
    • http://www.gorillawalker.com/pooh-s-learning-library-disney-s-i-can-learn-with.pdf
    • http://www.gorillawalker.com/the-medieval-mystical-tradition-in-england-papers-read-at-charney.pdf
    • http://www.gorillawalker.com/the-first-battle-of-the-first-world-war-alsace-lorraine.pdf
    • http://www.gorillawalker.com/vaughn-bode-s-erotica.pdf
    • http://www.gorillawalker.com/great-sermons-of-the-world-sermons-from-25-of-the.pdf
    • http://www.gorillawalker.com/norway-all-year-travel-directory-1998.pdf
    • http://www.gorillawalker.com/heritage-marketing.pdf
    • http://www.gorillawalker.com/communication-arts-2014-january-february-typography-annual-4-volume-55.pdf
    • http://www.gorillawalker.com/the-political-history-of-the-devil.pdf
    • http://www.gorillawalker.com/album-de-guitarra-facil-no-12-italian-edition.pdf
    • http://www.gorillawalker.com/the-memphis-sun-wick-poetry-chapbook-series-2.pdf
    • http://www.gorillawalker.com/made-in-america-sold-in-the-nam-second-edition-reflections.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.