Malicious PDF — malware analysis report

Static analysis result for SHA-256 e16d0f1d7c74cc8a…

MALICIOUS

PDF

32.2 KB Created: 2019-11-10 05:17:54 +03:00 Authoring application: Adobe Acrobat 8.13 (via Adobe Acrobat 8.13 Image Conversion Plug-in)
MD5: 15ba06372728fd5c07e23e8718c785ba SHA-1: c77ebc0cbcc8fd20486ea50ae53dae10324aa8a3 SHA-256: e16d0f1d7c74cc8a78998fb4103e6fc2fc72f4b7e9b8cd2f0007fe67f71a47b2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by multiple heuristics, including ClamAV and an ML classifier, for malicious content. The critical PDF_SEO_LINK_FARM heuristic indicates a large number of embedded external links, suggesting a link farm or distribution mechanism. The embedded URLs point to various PDF files hosted on www.gorillawalker.com.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8488

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7573787-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7573787-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/the-evolution-of-fashion-pattern-and-cut-from-1066-to.pdf
    • http://www.gorillawalker.com/supergods.pdf
    • http://www.gorillawalker.com/introduction-to-infrared-and-raman-spectroscopy.pdf
    • http://www.gorillawalker.com/in-my-life-the-beatles-ssaa-a-cappella-ttbb-acappel.pdf
    • http://www.gorillawalker.com/absolute-beginners-ukulele.pdf
    • http://www.gorillawalker.com/tuaregs-endangered-cultures.pdf
    • http://www.gorillawalker.com/mated-to-the-alpha-were-wolf-bbw-fertile-erotica.pdf
    • http://www.gorillawalker.com/testimonios-early-california-through-the-eyes-of-women-1815-150.pdf
    • http://www.gorillawalker.com/voices-in-court-a-treasury-of-the-law.pdf
    • http://www.gorillawalker.com/the-complete-idiot-s-guide-to-weird-word-origins.pdf
    • http://www.gorillawalker.com/sir-john-davies-and-the-conquest-of-ireland-a-study.pdf
    • http://www.gorillawalker.com/mathematics-and-calculations-for-agronomists-and-soil-scientists-british-imperical.pdf
    • http://www.gorillawalker.com/the-block-rug-with-3x5-inch-squares-a-vintage-1953.pdf
    • http://www.gorillawalker.com/make-your-own-rules-diet.pdf
    • http://www.gorillawalker.com/design-of-fishways-and-other-fish-facilities.pdf
    • http://www.gorillawalker.com/the-irish-statute-staple-books-1596-1687-with-cd-rom.pdf
    • http://www.gorillawalker.com/unusual-hotels-europe.pdf
    • http://www.gorillawalker.com/grammar-for-teachers-a-guide-to-american-english-for-native.pdf
    • http://www.gorillawalker.com/jaina-sutras-part-ii.pdf
    • http://www.gorillawalker.com/routledge-international-handbook-of-medical-education-routledge-international-handbooks.pdf
    • http://www.gorillawalker.com/history-of-gnosticism.pdf
    • http://www.gorillawalker.com/the-value-of-talent-promoting-talent-management-across-the-organization.pdf
    • http://www.gorillawalker.com/first-chicago-guide.pdf
    • http://www.gorillawalker.com/finance-and-leisure-llm.pdf
    • http://www.gorillawalker.com/mathematical-methods-for-physicists-sixth-edition-a-comprehensive-guide.pdf
    • http://www.gorillawalker.com/integrated-product-and-process-design-and-development-the-product-realization.pdf
    • http://www.gorillawalker.com/eyes-in-the-sky-eisenhower-the-cia-and-cold-war.pdf
    • http://www.gorillawalker.com/the-return-of-george-sutherland.pdf
    • http://www.gorillawalker.com/jazz-theory-and-practice.pdf
    • http://www.gorillawalker.com/whale-talk-kindle-edition.pdf
    • http://www.gorillawalker.com/population-genetics-and-evolution.pdf
    • http://www.gorillawalker.com/sister-sarah-s-west-viriginia-lucky-address-finders-kindle-edition.pdf
    • http://www.gorillawalker.com/el-gran-libro-del-tarot-manual-pr.pdf
    • http://www.gorillawalker.com/symphony-no-42-in-d-major-hob-i-42-full.pdf
    • http://www.gorillawalker.com/finite-mathematics-third-edition.pdf
    • http://www.gorillawalker.com/night-dancer.pdf
    • http://www.gorillawalker.com/the-spiritual-guidance-of-the-individual-and-humanity-some-results.pdf
    • http://www.gorillawalker.com/increasing-real-estate-sales-through-exchanging.pdf
    • http://www.gorillawalker.com/stories-in-stone-the-complete-guide-to-cemetery-symbolism-and.pdf
    • http://www.gorillawalker.com/reversing-dry-eye-syndrome-practical-ways-to-improve-your-comfort.pdf
    • http://www.gorillawalker.c
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.