Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7c8d41d5d7d959d…

MALICIOUS

PDF

43.5 KB Created: 2019-02-15 09:00:55 +03:00 Authoring application: Acrobat PDFMaker 7.0 для Word (via Acrobat Distiller 7.0.5 (Windows))
MD5: 11ca97ad528c694de6c7be1df06ac62d SHA-1: 736290d3b059b0bcd161335c378b088e2eb63ea9 SHA-256: c7c8d41d5d7d959df4472d15e2fdd23b11a617c37b4b05beff80c332954be6b3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by ClamAV as Pdf.Dropper.Agent-7139861-0 and a machine learning model. The critical heuristic PDF_SEO_LINK_FARM indicates the presence of 32 external PDF links, suggesting a link farm or redirection tactic. The document body is heavily obfuscated and does not provide clear textual lures, but the sheer volume of links points towards a malicious intent to distribute further content or manipulate search results.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8452

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7139861-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7139861-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-effect-of-disciplinary-determinations-on-civil-suits-involving-engineers.pdf
    • http://www.gorillawalker.com/language-of-multilateral-diplomacy-english-russian-explanatory-dictionary-russian-edition.pdf
    • http://www.gorillawalker.com/snoring-from-a-to-zzzz-proven-cures-for-the-night.pdf
    • http://www.gorillawalker.com/the-architecture-of-frank-lloyd-wright-a-complete-catalog-updated.pdf
    • http://www.gorillawalker.com/the-pentateuch-and-old-testament-books-of-history-biblical-foundations.pdf
    • http://www.gorillawalker.com/a-shorter-course-of-theoretical-physics-vol-2-quantum-mechanics.pdf
    • http://www.gorillawalker.com/2015-monthly-planner-vintage-cover-day-planners-organizers-calendars-volume.pdf
    • http://www.gorillawalker.com/skeleton-women-kindle-edition.pdf
    • http://www.gorillawalker.com/angkor-an-introduction-to-the-temples-odyssey-guides.pdf
    • http://www.gorillawalker.com/ghost-towns-scary-places.pdf
    • http://www.gorillawalker.com/find-out-about-flight-with-18-projects-and-more-than.pdf
    • http://www.gorillawalker.com/vampire-berserker.pdf
    • http://www.gorillawalker.com/otologia-otology-spanish-edition.pdf
    • http://www.gorillawalker.com/super-safari-level-1-pupil-s-book-with-dvd-rom.pdf
    • http://www.gorillawalker.com/applied-pharmacology-for-the-dental-hygienist-4th-ed-review-book.pdf
    • http://www.gorillawalker.com/cameron-hydraulic-data-a-handy-reference-on-the-subjects-of.pdf
    • http://www.gorillawalker.com/scada-supervisory-control-and-data-acquisition-3rd-edition.pdf
    • http://www.gorillawalker.com/purse-fabric-medium-brown-bible-cover.pdf
    • http://www.gorillawalker.com/minor-buddhist-text-part-1.pdf
    • http://www.gorillawalker.com/the-5-biological-laws-the-skin-and-skin-allergies-dr.pdf
    • http://www.gorillawalker.com/huey-the-story-of-an-assault-helicopter-pilot-in-vietnam.pdf
    • http://www.gorillawalker.com/fighting-art-of-tang-soo-do-unique-literary-books-of.pdf
    • http://www.gorillawalker.com/a-handbook-of-pastoral-counselling-mowbray-parish-handbooks.pdf
    • http://www.gorillawalker.com/bi-curious-3-trapped.pdf
    • http://www.gorillawalker.com/what-does-it-mean-to-be-united-methodist-leader-s.pdf
    • http://www.gorillawalker.com/the-everything-cover-letter-book-everything.pdf
    • http://www.gorillawalker.com/atlas-of-gynecological-surgery.pdf
    • http://www.gorillawalker.com/study-guide-for-1z0-144-oracle-database-11g-program-with.pdf
    • http://www.gorillawalker.com/the-enculturated-gene-sickle-cell-health-politics-and-biological-difference.pdf
    • http://www.gorillawalker.com/beer-advertising-memorabilia.pdf
    • http://www.gorillawalker.com/essentials-pediatric-nursing-ctb.pdf
    • http://www.gorillawalker.com/advanced-mechanics-of-materials-2nd-edition.pdf
    • http://www.gorillawalker.com/hydraulics-fifth-edition.pdf
    • http://www.gorillawalker.com/math-mazes-and-more-stick-kids-workbook-grade-1-stick.pdf
    • http://www.gorillawalker.com/introduction-to-ordinary-differential-equations-4th-edition.pdf
    • http://www.gorillawalker.com/the-sevenpenny-gate-a-lifelong-love-affair-with-celtic-fc.pdf
    • http://www.gorillawalker.com/loosening-the-grip-a-handbook-of-alcohol-information-with-powerweb.pdf
    • http://www.gorillawalker.com/conservative-management-of-sports-injuries.pdf
    • http://www.gorillawalker.com/the-don-juan-legend-before-mozart-with-a-collection-of.pdf
    • http://www.gorillawalker.com/gala-day-luncheons-a-little-book-of-suggestions.pdf
    • http://www.gorillawalker.com/the-pentateuch-and-old-testament-books-of-history-biblical-foun
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.