Malicious PDF — malware analysis report

Static analysis result for SHA-256 0797a30b01fae8fc…

MALICIOUS

PDF

124.5 KB Created: 2022-07-06 12:01:09 +00:00 Authoring application: latsatu (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: b119eb69e806d560cb12f759c4a6a330 SHA-1: daa9bfebf553851bf1ad371673549a1a12f538b6 SHA-256: 0797a30b01fae8fcf1ccd3287bdca9a3bbffd2439046f86404cea8a12279f046
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which appear to be SEO-optimized to lure users into downloading software. One prominent URL, http://evacdir.com/comuter.cgmp?ZG93bmxvYWR8SU00YTJsellueDhNVFkxTnpBMk56RTFOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=/TWluaVRvb2wgUG93ZXIgRGF0YSBSZWNvdmVyeSBGcmVlIEVkaXRpb24gOC4xIENyYWNrTWl/firestorms/icann/, is likely a malicious download. The PDF structure and link farm suggest an attempt to distribute potentially unwanted or malicious software.

Machine Learning

  • Nyx PDF Classifier clean score 0.0139

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/comuter.cgmp?ZG93bmxvYWR8SU00YTJsellueDhNVFkxTnpBMk56RTFOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=/TWluaVRvb2wgUG93ZXIgRGF0YSBSZWNvdmVyeSBGcmVlIEVkaXRpb24gOC4xIENyYWNrTWl/firestorms/icann/
    • http://www.giffa.ru/fashionjewelry/luminar-4-crack-new-keygen-free-download/
    • https://thebrothers.cl/wp-content/uploads/2022/07/paxjan.pdf
    • https://ready2reading.com/wp-content/uploads/2022/07/Adobe_Acrobat_Xi_Pro_Free_Download_For_Windows_8_FULL.pdf
    • https://www.realvalueproducts.com/sites/realvalueproducts.com/files/webform/men-of-war-vietnam-v-1001-full-trainer.pdf
    • https://khadijahshowroom.com/2022/07/06/wwe-smackdown-vs-raw-2006-pc-version-fitgirl-repack-extra-quality/
    • https://wishfruits.com/cadprofi-9-07-patched-keygen-crack/
    • https://powerful-badlands-19627.herokuapp.com/ghazymr.pdf
    • https://dry-mesa-00465.herokuapp.com/markkeir.pdf
    • https://yooyi.properties/wp-content/uploads/2022/07/ShestheManHDTV720px264.pdf
    • https://technospace.co.in/upload/files/2022/07/8FBqUpWZvyoLYUZgq89R_06_dc9555fcabba6984566e8b6e04da2fda_file.pdf
    • https://www.southwickma.org/sites/g/files/vyhlif1241/f/uploads/zoning_districts_1.pdf
    • https://whispering-shelf-10023.herokuapp.com/janealis.pdf
    • https://www.farmington.nh.us/sites/g/files/vyhlif566/f/uploads/transfer_station_information_flyer.pdf
    • https://www.lmbchealth.com/advert/high-standard-sport-king-serial-number-lookup-install/
    • http://joshuatestwebsite.com/hd-online-player-asterisk-essentials-online-video-tra-work/
    • http://conbluetooth.net/?p=26186
    • https://www.spanko.net/upload/files/2022/07/gGgSZJvtCF2SYwX5bMbz_06_429c445c2e633ab5f8850c823c4ea082_file.pdf
    • https://okutimur.com/wp-content/uploads/2022/07/Epson_sx230_resetrar.pdf
    • https://www.tamtam.boutique/wp-content/uploads/2022/07/verrgebh.pdf
    • http://www.giffa.ru/fashionjewelry/luminar-4-crack-new-keygen-free-
    • https://ready2reading.com/wp-content/uploads/2022/07/Adobe_Acro
    • https://www.realvalueproducts.com/sites/realvalueproducts.com/files
    • https://khadijahshowroom.com/2022/07/06/wwe-smackdown-vs-
    • https://yooyi.properties/wp-
    • https://technospace.co.in/upload/files/2022/07/8FBqUpWZvyoLYUZgq
    • https://www.southwickma.org/sites/g/files/vyhlif1241/f/uploads/zonin
    • https://www.farmington.nh.us/sites/g/files/vyhlif566/f/uploads/transfe
    • https://www.lmbchealth.com/advert/high-standard-sport-king-serial-
    • http://joshuatestwebsite.com/hd-online-player-asterisk-essentials-
    • https://www.spanko.net/upload/files/2022/07/gGgSZJvtCF2SYwX5bM
    • https://okutimur.com/wp-
    • https://www.tamtam.boutique/wp-
    • https://library.uoregon.edu/system/files/webform/apc_application/halglad760.pdf
    • http://www.tcpdf.org
    • https://library.uoregon.edu/system/files/webform/apc_application/hal
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/