PDF static analysis report

Static analysis result for SHA-256 0644edf1c555428f…

SUSPICIOUS

PDF

133.1 KB Created: 2022-07-04 03:07:35 +00:00 Authoring application: gavrade (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 29fec97100e0598cdd3ff0f2c8ab0bd0 SHA-1: f41b690c751f41e6f4200656459f6569ab20392a SHA-256: 0644edf1c555428f11012650ccc1295a160fda1e6beedd930ec333d7b943a830
34 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs that advertise cracked software, indicating a lure to trick users into downloading potentially malicious files. One heuristic specifically flagged the document for advertising cracked software links. The presence of numerous unknown reputation URLs suggests a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.0070

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thedirsite.com/nonsense.automakers?/liquidbrandsmanagement/U3VwZXIgRW1haWwgRXh0cmFjdG9yU3V/mutations/pore/ZG93bmxvYWR8enQyTkhKcFlYeDhNVFkxTmpnNU1qTTFNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/practitioners PDF link annotation
    • http://www.gorelim.com/?p=5622In PDF document text
    • https://lear.orangeslash.com/advert/mz-vista-force-11-0-3-1-with-keygen-win-mac-latest-2022/In PDF document text
    • https://www.suvcars.com/advert/management-ware-automated-tweet-free-edition-free/In PDF document text
    • https://taavistea.com/wp-content/uploads/2022/07/Macallan_Mail_Solution.pdfIn PDF document text
    • https://elycash.com/upload/files/2022/07/axAFQDaGd9vRoJzoTU8g_04_78e06888f409900df2db933c3e00ff75_file.pdfIn PDF document text
    • http://www.louxiran.com/flash-card-reveal-crack/In PDF document text
    • https://afternoon-caverns-11152.herokuapp.com/DateTime2.pdfIn PDF document text
    • https://sbrelo.com/upload/files/2022/07/aztmWcGs32YDW3Zf9Yr9_04_caaa4320bbad1db5b509988f103297fc_file.pdfIn PDF document text
    • https://xn--80aagyardii6h.xn--p1ai/mssql-to-mysql-code-converter/In PDF document text
    • http://2c63.com/?p=10118In PDF document text
    • http://awaazsachki.com/?p=41405In PDF document text
    • https://fierce-mesa-90432.herokuapp.com/tancneb.pdfIn PDF document text
    • https://fieldstationoutreach.info/wp-content/uploads/2022/07/wylhlen.pdfIn PDF document text
    • https://secret-ridge-22501.herokuapp.com/imogmalv.pdfIn PDF document text
    • https://www.sertani.com/upload/files/2022/07/oEnm61Z9zdkgJayl7p6h_04_6b2427c0e9d876f1ce5ab8e7acf38fe2_file.pdfIn PDF document text
    • http://shippingcasesnow.com/?p=7336In PDF document text
    • https://cryptic-taiga-57291.herokuapp.com/Microsoft_Dynamics_CRM_2013_Custom_Code_Validation_Tool.pdfIn PDF document text
    • https://rowpgappsokwayralo.wixsite.com/manatanag/post/mautoequalizer-crack-keygen-download-for-windowsIn PDF document text
    • http://sochaport.yolasite.com/resources/BSRecover--Crack---Download.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
    • http://sochaport.yolasite.com/resources/bsrecover--crack---download.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off0001a6b9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A6B9 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7

Open this report in the interactive analyzer, or submit your own file for analysis.