Malicious PDF — malware analysis report

Static analysis result for SHA-256 0223cc1ebdfdeea7…

MALICIOUS

PDF

135.0 KB Created: 2022-06-12 21:05:43 +02:00 Authoring application: justnal (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 146f251fe1f4bb86efaddb61f3f346e0 SHA-1: 8365e3cf1f83703de8a1860ba37d24b179ff70f2 SHA-256: 0223cc1ebdfdeea7201434b6c2ad10ac7b6781785da9d15663cffe36895f383f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which are associated with cracked software lures. One of the extracted URLs, http://evacdir.com/helobacter.addictive, appears to be a malicious redirect or download link. The document body is heavily obfuscated, preventing a clear understanding of its direct intent beyond the link farm.

Machine Learning

  • Nyx PDF Classifier clean score 0.0123

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/helobacter.addictive?closeup=judaism&mailmen&cHJlc2J5dGVyaWFuIGh5bW5zIGluIHR3aSBwZGYgMzIwcHJ=gmail&ZG93bmxvYWR8cTlGYm5VNU1IeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=significance
    • http://ecoteer.com/wp-content/uploads/2022/06/neyldest.pdf
    • https://amazeme.pl/wp-content/uploads/2022/06/Dr_Faustus_In_Urdu_Pdf_11.pdf
    • https://aprendeconmontessori.com/wp-content/uploads/2022/06/Silver_Creek_Falls_Chapter_2.pdf
    • https://zymlink.com/advert/keygen-sis-2011b/
    • http://ticketguatemala.com/wp-content/uploads/2022/06/Princesse_Sofia_Lien_Torrent_Cpasbien.pdf
    • https://jyotienterprises.net/wp-content/uploads/2022/06/Globe_Extractorexe_rar.pdf
    • https://wocfolx.com/upload/files/2022/06/3rGKq9EZIPE8FopXj3e6_12_e95141007e36bed4a9595fa50858a2e9_file.pdf
    • http://touchdownhotels.com/max-payne-3-v1-0-0-22-patch-cracked-read-nfo-theta-latest-version/
    • https://thecryptowars.com/recovermyfilesv5101824licensekeyrar-upd/
    • https://thingstosale.com/advert/cooper-stanica-3-izdanje-download-free/
    • https://outdoormingle.com/wp-content/uploads/2022/06/berwgerm.pdf
    • https://thebrothers.cl/cast-away-2000-bluray-720p-900mb-ganool/
    • https://alfagomeopatia.ru/wp-content/uploads/taisho_x_alice_episode_1_free_download_pc_game.pdf
    • http://uniqueadvantage.info/hd-online-player-cevio-creative-studio-crack-22-link/
    • https://forbesreality.com/wp-content/uploads/2022/06/Piezoelectric_Ceramics_Principles_And_Applications_Ebook_16.pdf
    • https://cooltto.com/wp-content/uploads/onekey_ghost_windows_8_64_bit.pdf
    • https://gamersmotion.com/microsoft-forefront-unified-access-gateway-2010-x64-dvdlibiso/
    • https://keephush.net/wp-content/uploads/2022/06/Physiological_Control_Systems_Solutions_Manual_Michael_Khoo.pdf
    • https://lynonline.com/2022/06/12/alina-balletstar-jessy-sunshine-petal-of-stone-final/
    • http://ticketguatemala.com/wp-content/uploads/2022/06/princesse_sofia_lien_torrent_cpasbien.pdf
    • https://secureservercdn.net/198.71.233.27/o6g.aec.myftpupload.com/wp-content/uploads/2022/06/augtrev-1.pdf?time=1655060732
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000f74.bin
a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF74 120140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.