Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccb3300398aedced…

MALICIOUS

PDF

34.1 KB Created: 2019-08-07 05:46:25 +03:00 Authoring application: - (via Acrobat Distiller Daemon 3.0 for Solaris 2.3 and later (SPARC))
MD5: 971ad7cba4c6dc6ee736086bdda7d13b SHA-1: 71c733391fd4dda55f3315b02101685243e96559 SHA-256: ccb3300398aedcedee3b8d79b81491499785f923cd6ff1efe460902a20c76a98
92 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The file was detected as malicious by ClamAV and an ML classifier, indicating it is a dropper. The PDF contains multiple external URIs pointing to various PDF files on the 'gorillawalker.com' domain. These URIs likely serve as download locations for second-stage malware, a common tactic for PDF-based droppers.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8735

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7138994-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7138994-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/benzo-wise-a-recovery-companion.pdf
    • http://www.gorillawalker.com/macroeconomics-student-value-edition-2nd-edition.pdf
    • http://www.gorillawalker.com/real-estate-agent-s-business-planning-guide.pdf
    • http://www.gorillawalker.com/goncharova-stage-designs-and-paintings.pdf
    • http://www.gorillawalker.com/saints-on-stage-an-anthology-of-mormon-drama.pdf
    • http://www.gorillawalker.com/gimme-the-recipe.pdf
    • http://www.gorillawalker.com/seeing-the-whole-mapping-the-extended-value-stream-lean-enterprise.pdf
    • http://www.gorillawalker.com/making-the-diagnosis-a-practical-guide-to-breast-imaging-expert.pdf
    • http://www.gorillawalker.com/managing-global-development-risk-kindle-edition.pdf
    • http://www.gorillawalker.com/how-are-digital-devices-impacting-society-in-controversy.pdf
    • http://www.gorillawalker.com/rethinking-education-in-the-age-of-technology-the-digital-revolution.pdf
    • http://www.gorillawalker.com/time-varying-image-processing-and-moving-object-recognition-4.pdf
    • http://www.gorillawalker.com/take-the-lead-motivate-inspire-and-bring-out-the-best.pdf
    • http://www.gorillawalker.com/aging-and-old-age-style-in-g-nter-grass-ruth.pdf
    • http://www.gorillawalker.com/over-the-river-and-through-the-wood-the-new-england.pdf
    • http://www.gorillawalker.com/vector-methods-applied-to-differential-geometry-mechanics-and-potential-theory.pdf
    • http://www.gorillawalker.com/understanding-human-sexuality-11th-edition.pdf
    • http://www.gorillawalker.com/number-crunch-your-way-around-australia-math-exploration-using-math.pdf
    • http://www.gorillawalker.com/thunderbolt-the-republic-p-47-thunderbolt-in-the-european-theater.pdf
    • http://www.gorillawalker.com/triathlon-training-in-4-hours-a-week-from-beginner-to.pdf
    • http://www.gorillawalker.com/servamp-vol-5.pdf
    • http://www.gorillawalker.com/alejandro-magno-libros-singulares-spanish-edition.pdf
    • http://www.gorillawalker.com/surviving-doomsday.pdf
    • http://www.gorillawalker.com/enterprise-service-bus-theory-in-practice-kindle-edition.pdf
    • http://www.gorillawalker.com/into-the-pensieve-the-philosophy-and-mythology-of-harry-potter.pdf
    • http://www.gorillawalker.com/the-guitar-music-of-spain-volume-one-over-fifty-traditional.pdf
    • http://www.gorillawalker.com/infinity-turtleback-school-library-binding-edition-numbers.pdf
    • http://www.gorillawalker.com/candy-crush-soda-saga-unofficial-game-guide-tips-cheats-tricks.pdf
    • http://www.gorillawalker.com/martensville-truth-or-justice.pdf
    • http://www.gorillawalker.com/70-ideas-for-summer-and-fall-activities-kindle-edition.pdf
    • http://www.gorillawalker.com/surgical-recall-6th-edition-recall-series.pdf
    • http://www.gorillawalker.com/publishing-and-multimedia-law-a-practical-guide.pdf
    • http://www.gorillawalker.com/hell-bent-for-leather-confessions-d-un-accro-au-heavy.pdf
    • http://www.gorillawalker.com/advent-trilogy-solo-tenor-sax-clarinet-trumpet-piano.pdf
    • http://www.gorillawalker.com/american-buildings-and-their-architects-the-colonial-and-neo-classical.pdf
    • http://www.gorillawalker.com/farm-holiday-guide-1999-england-wales-ireland-and-the-channel.pdf
    • http://www.gorillawalker.com/in-the-places-of-the-spirits.pdf
    • http://www.gorillawalker.com/weider-book-of-bodybuilding-for-women.pdf
    • http://www.gorillawalker.com/the-book-of-burger.pdf
    • http://www.gorillawalker.com/the-monster-guide-to-horror-movies.pdf
    • http://www.gorillawalker.com/how-are-digital-devices-impacting-society-in-contr
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.