Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a2c34c716b6915b…

MALICIOUS

PDF

137.3 KB Created: 2022-07-07 11:27:21 +00:00 Authoring application: chahak (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 203dd12ad26793cebd1ef131d1ca8000 SHA-1: 7fe1082ad0812624ecc77a0552c7d3b74d4d6fb4 SHA-256: 1a2c34c716b6915b9914201edd63c7878c97b441aa6dc7ace4151e1ac472b463
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are SEO-optimized and point to other PDF files. The primary URL identified, http://siteslocate.com/alliedhighschool/nishayam/barracks/horticulturalist/cumbria?ZG93bmxvYWR8SDdMTW1JMGRYeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=overcome&eGZvcmNlIGtleWdlbiBJbmZyYXN0cnVjdHVyZSBEZXNpZ24gU3VpdGUgMjAxOSBGcmVlIERvd2..., likely serves as a lure to download further malicious content. This indicates a link farm or SEO poisoning attack designed to distribute malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0100

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://siteslocate.com/alliedhighschool/nishayam/barracks/horticulturalist/cumbria?ZG93bmxvYWR8SDdMTW1JMGRYeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=overcome&eGZvcmNlIGtleWdlbiBJbmZyYXN0cnVjdHVyZSBEZXNpZ24gU3VpdGUgMjAxOSBGcmVlIERvd25sb2FkeGZ=
    • https://hissme.com/upload/files/2022/07/FflVrECTBZ3Mbe2ILN9R_07_c2c18f7d1d60cb49385cadc39e4f3929_file.pdf
    • https://www.cameraitacina.com/en/system/files/webform/feedback/sylvius-4-free-download.pdf
    • https://natepute.com/advert/dassault-systems-catia-v5r17-p3-crack-portable-2/
    • https://haldibazaar.com/heroes-of-might-and-magic-6-keygen-upd-download/
    • https://hhinst.com/advert/epson-resetter-2021-keygen/
    • http://adomemorial.com/2022/07/07/synology-surveillance-station-6-license-new-keygen-torrent/
    • https://mandarinrecruitment.com/system/files/webform/signcut-163-1.pdf
    • https://morefxoptions.com/wp-content/uploads/2022/07/helhar.pdf
    • https://ubex.in/wp-content/uploads/2022/07/Crack_Numero_De_Serie_Crysis_2_TOP.pdf
    • http://www.trabajosfacilespr.com/adobe-acrobat-pro-dc-2020-006-20034-keygen-patch-high-quality/
    • https://over-the-blues.com/advert/tai-matlab-6-5-full-2021-crack/
    • https://www.cnaclassnorthernva.com/wp-content/uploads/2022/07/XFORCE_LINK_Keygen_ArtCAM_2006.pdf
    • https://www.reperiohumancapital.com/system/files/webform/reagenn238.pdf
    • https://octopi.nl/wp-content/uploads/2022/07/FotoJet_Designer_116_Crack_Full_Version_Download.pdf
    • http://compasscarrier.com/cinemaparadisobrrip1080pduallatino/
    • https://hissme.com/upload/files/2022/07/FflVrECTBZ3Mbe2ILN9R_07_c2c18f7d1d60cb49385cadc39e
    • https://www.cnaclassnorthernva.com/wp-
    • https://octopi.nl/wp-
    • https://tdetopisgisdocahoc.wixsite.com/porofseoti::porofseoti:7GZUxgUjtq:tdetopisgisdocahocu@hotmail.com/post/full-eset-nod32-antivirus-v10-0-390-0-final-crack-softhound-exclusive
    • https://circles.nyc3.digitaloceanspaces.com/upload/files/2022/07/ktjvruyTW4vEkSXqsRDa_07_28f0f4d674b225747bc299f9a1bfa09d_file.pdf
    • https://trello.com/c/rP8s1dMP/47-hd-online-player-the-concubine-korean-movie-2012-14-link
    • https://wakelet.com/wake/16cTu0qIUt6pEetzTIVIP
    • http://celtifest.yolasite.com/resources/Crack-HOT-Windows-7-Sp1-AIO-x86x64-11in1-Enus-May2016-Incl-Activator-T.pdf
    • http://www.tcpdf.org
    • https://tdetopisgisdocahoc.wixsite.com/porofseoti::porofseoti:7GZUxgUjtq:tdetopisgisdocahocu@hot
    • https://circles.nyc3.digitaloceanspaces.com/upload/files/2022/07/ktjvruyTW4vEkSXqsRDa_07_28f0f4
    • http://celtifest.yolasite.com/resources/Crack-HOT-Windows-7-Sp1-AIO-x86x64-11in1-Enus-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.