Malicious PDF — malware analysis report

Static analysis result for SHA-256 3074b1b3cf56bf56…

MALICIOUS

PDF

117.4 KB Created: 2022-07-04 04:12:38 +00:00 Authoring application: odeeloi (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: b4a39e749707a9f0b065eeef0103da80 SHA-1: c8f16ec435aabb763ebc0dec716a5f4943a5a70b SHA-256: 3074b1b3cf56bf5676f4014ece9ab243a10cd6063660831013343a6a0c67e2c4
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of external links, many of which are disguised as downloads for cracked software. One of the extracted URLs, http://find24hs.com/burges.ZG93bmxvYWR8MUd2Tm1KcVozeDhNVFkxTmpnNU1qTTFNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/V2VpZ2h0SHViV2V?responsible=festers&shifuku=wardour, appears to be a malicious download link. The presence of numerous links to potentially unwanted software suggests a deceptive tactic to compromise users.

Machine Learning

  • Nyx PDF Classifier clean score 0.0119

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://find24hs.com/burges.ZG93bmxvYWR8MUd2Tm1KcVozeDhNVFkxTmpnNU1qTTFNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/V2VpZ2h0SHViV2V?responsible=festers&shifuku=wardour PDF link annotation
    • https://tattooshopreviews.com/wp-content/uploads/2022/07/weriopel.pdfIn PDF document text
    • https://thelacypost.com/muxman-torrent-activation-code-win-mac-2022/In PDF document text
    • https://ulrichs-flachsmeer.de/wp-content/uploads/2022/07/Colorado.pdfIn PDF document text
    • https://visitforres.scot/easy-xml-converter-crack-activation-code-with-keygen-win-mac/In PDF document text
    • https://parleafrique.com/wp-content/uploads/2022/07/jolfly.pdfIn PDF document text
    • https://lighthousehealing.org/photo-stock-agency-screensaver-crack-license-key-full-download/In PDF document text
    • https://www.7desideri.it/date-reminder-crack-free-download-for-windows/In PDF document text
    • https://www.cdnapolicity.it/wp-content/uploads/2022/07/berlgia.pdfIn PDF document text
    • https://richard-wagner-werkstatt.com/wp-content/uploads/2022/07/NodeXL_Class_Libraries__Crack__Free_Download_PCWindows_Latest.pdfIn PDF document text
    • https://awamagazine.info/advert/drbl-winroll-crack-product-key-for-windows/In PDF document text
    • https://poetbook.com/upload/files/2022/07/FOG1IYVy5CchiJ6Q5UwO_04_11e34990cc4a3a42ac8fbd25a4edd9f4_file.pdfIn PDF document text
    • https://ajkersebok.com/audio-renderer-changer-2010-29-270-357-crack-activation-key-free-download/In PDF document text
    • https://nysccommunity.com/advert/bali-calc-crack-free-license-key-pc-windows/In PDF document text
    • https://www.easyblogging.in/wp-content/uploads/2022/07/Amazing_Dusk__Crack_Torrent_Download_For_Windows_April2022.pdfIn PDF document text
    • https://versiis.com/38192/tunatic-crack-free-download-updated-2022/In PDF document text
    • https://besttoolguide.com/2022/07/04/messagesave-crack-with-license-code/In PDF document text
    • https://www.acvconsultoria.com/wp-content/uploads/2022/07/Asoftis_IP_Changer.pdfIn PDF document text
    • https://arcmaxarchitect.com/sites/default/files/webform/defragmenter-pro-plus.pdfIn PDF document text
    • https://voltigieren-bb.de/advert/smoz-start-menu-organizer-crack-free-download-for-windows/In PDF document text
    • http://nakatlie.yolasite.com/resources/Panda-5-For-Chrome-Crack---License-Keygen-2022.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
    • http://nakatlie.yolasite.com/resources/panda-5-for-chrome-crack---license-keygen-2022.pdfIn PDF document text