Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3577924bdd34699…

MALICIOUS

PDF

42.5 KB Created: 2018-11-23 08:08:33 +03:00 Authoring application: Writer (via OpenOffice.org 1.1.2)
MD5: 8c0da4071ad0128728ca32719d69ac9f SHA-1: 3c1b22943af97e6b2d632067f7dcb934a6acaf51 SHA-256: d3577924bdd3469903b99920ab5c172b170b3ed07c2bcdaf4786d617c4b06a3c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was detected as Pdf.Dropper.Agent-7307922-0 by ClamAV. Static analysis revealed a PDF_SEO_LINK_FARM heuristic, indicating the presence of numerous external links. The document body, though heavily obfuscated, contains many URLs pointing to external PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The primary attack pattern involves leveraging these links for SEO manipulation or to lure users to malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7307922-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7307922-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/studies-in-algebraic-geometry-studies-in-mathematics-volume-20.pdf
    • http://www.gorillawalker.com/freshwater-fishes-of-texas-a-field-guide-river-books-sponsored.pdf
    • http://www.gorillawalker.com/beneath-the-raven-s-moon.pdf
    • http://www.gorillawalker.com/stop-snoring-naturally-kindle-edition.pdf
    • http://www.gorillawalker.com/the-low-carbohydrate-diet-for-triathletes-official-nutrition-guide-to.pdf
    • http://www.gorillawalker.com/purchasing-and-supply-chain-management-frameworks.pdf
    • http://www.gorillawalker.com/the-art-of-speculation.pdf
    • http://www.gorillawalker.com/star-wars-frames-100-postcards.pdf
    • http://www.gorillawalker.com/ellis-island.pdf
    • http://www.gorillawalker.com/adc-the-map-people-kent-county-delaware-street-atlas.pdf
    • http://www.gorillawalker.com/outpost.pdf
    • http://www.gorillawalker.com/history-of-scituate-massachusetts.pdf
    • http://www.gorillawalker.com/oman-the-true-life-drama-and-intrigue-of-an-arab.pdf
    • http://www.gorillawalker.com/official-price-guide-to-country-music-records-1st-edition.pdf
    • http://www.gorillawalker.com/a-dark-and-stormy-romance-kindle-edition.pdf
    • http://www.gorillawalker.com/what-every-student-should-know-about-researching-online-2nd-edition.pdf
    • http://www.gorillawalker.com/matrices-over-commutative-rings-chapman-hall-pure-and-applied-mathematics.pdf
    • http://www.gorillawalker.com/permanent-magnet-motor-technology-design-and-applications-second-edition-electrical.pdf
    • http://www.gorillawalker.com/lessons-of-the-holy-spirit.pdf
    • http://www.gorillawalker.com/topology-a-first-course.pdf
    • http://www.gorillawalker.com/lost-mountain-a-year-in-the-vanishing-wilderness-radical-strip.pdf
    • http://www.gorillawalker.com/spectrum-spelling-grade-2.pdf
    • http://www.gorillawalker.com/an-armagh-childhood.pdf
    • http://www.gorillawalker.com/open-your-legs-really-wide-for-me-the-office-visit.pdf
    • http://www.gorillawalker.com/mind-your-manners-managing-business-culture-in-the-new-global.pdf
    • http://www.gorillawalker.com/ripple-effects-ten-west-michigan-nonprofits-serve-inspire-transform.pdf
    • http://www.gorillawalker.com/biology-of-amphibians.pdf
    • http://www.gorillawalker.com/the-black-cowboy-coloring-book-a-bellerophon-coloring-book.pdf
    • http://www.gorillawalker.com/surgical-management-of-cerebrovascular-disease-acta-neurochirurgica-supplement.pdf
    • http://www.gorillawalker.com/games-people-play-game-theory-in-life-business-and-beyond.pdf
    • http://www.gorillawalker.com/global-mission-handbook-a-guide-for-crosscultural-service.pdf
    • http://www.gorillawalker.com/blank-cookbook-cakes-blank-recipe-book-recipe-keeper-for-your.pdf
    • http://www.gorillawalker.com/hiking-the-grand-canyon-trail-map.pdf
    • http://www.gorillawalker.com/aero-hydrodynamics-of-sailing.pdf
    • http://www.gorillawalker.com/microstrip-lines-and-slotlines-third-edition-artech-house-microwave-library.pdf
    • http://www.gorillawalker.com/getting-along-exploring-the-jungle-of-women-s-relationships.pdf
    • http://www.gorillawalker.com/amor-sacro-e-profano-modelle-und-modellierungen-der-liebe-in.pdf
    • http://www.gorillawalker.com/what-do-you-really-want-for-your-children.pdf
    • http://www.gorillawalker.com/pre-columbian-architecture-in-mesoamerica.pdf
    • http://www.gorillawalker.com/tight-lines-ten-years-of-the-yale-anglers-journal.pdf
    • http://www.goril
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.