Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cec40ae0d01075b…

MALICIOUS

PDF

125.5 KB Created: 2022-07-03 14:40:50 +00:00 Authoring application: vyrgelyz (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 7cda5936267b7f22ad5fc4bf4178a4f0 SHA-1: 950b8e9a5f8f2562158bae9c79c37a6e79a3699f SHA-256: 3cec40ae0d01075ba7d2dcd7d81637a983ae60c9d33beb5adb9884b749763c33
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple links advertising cracked software, indicating a lure to download potentially malicious applications. One heuristic specifically flags the document for promoting cracked software links. The presence of a 'Password-protected archive handoff' heuristic suggests the document may be part of a multi-stage attack, where the password is provided to decrypt a payload after initial gateway scanning.

Machine Learning

  • Nyx PDF Classifier clean score 0.0119

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sitesworlds.com/berger/Q29uZmlndXJhciBMYW5wcm8gTHAtNTQyMGcgQ29tbyBBY2Nlc3MgUG9pbnQQ29.pharmacists.berrymnan.ZG93bmxvYWR8V0QwZFhkbVpIeDhNVFkxTmpjM01UZ3hPSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/activating.cryptozoology./ PDF link annotation
    • http://fulpat.com/system/files/webform/resumes/remebiag46.pdfIn PDF document text
    • https://chichiama.net/inpixio-photo-editor-home-v1-5-6024-keygen-crack-__link__ingpatching-unblocked-tube/In PDF document text
    • https://ccgs.vic.edu.au/system/files/webform/naplan/wesnad683.pdfIn PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/onydsas821.pdfIn PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/sonik-synth-2-serial-number-114.pdfIn PDF document text
    • http://www.strelkabrno.cz/advert/solved-bagatrix-product-keys-31-new/In PDF document text
    • https://thegoodsreporter.com/insider/george-bohlander-administracion-de-recursos-humanos-pdf-download-fixed/In PDF document text
    • http://www.naglobalbusiness.com/home/camtasia-studio-8-0-3-build-1018-upd-keygen/In PDF document text
    • https://social.arpaclick.com/upload/files/2022/07/yRokr1cqXoDUUFxJOYR4_03_191d7fc109a2554a775bbbb317337ee6_file.pdfIn PDF document text
    • http://www.sparepartsdiesel.com/upload/files/2022/07/T1j3mAPgfusQLMyIHVEP_03_191d7fc109a2554a775bbbb317337ee6_file.pdfIn PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/Account-Premium-Meet-N-Fuck.pdfIn PDF document text
    • http://zakadiconsultant.com/?p=12366In PDF document text
    • https://pediatricptpal.com/wp-content/uploads/2022/07/CheVolume_0_4_1_2_Cracked_Zip_FULL.pdfIn PDF document text
    • https://newsonbox.com/download-crackedbukufiqihwanitalengkappdf/In PDF document text
    • https://urps-paca-chd.fr/wp-content/uploads/2022/07/Halo4_Reloadedrar_Password.pdfIn PDF document text
    • https://in-loving-memory.online/hd-online-player-elegantangelkarliemontanaridesstrong-better/In PDF document text
    • https://orbeeari.com/violetta-saison-2-torrent/In PDF document text
    • https://www.sb20ireland.com/advert/portable-crack-microsoft-office-pro-plus-2016-x86x64-v16-0-4549-1000-sh/In PDF document text
    • https://www.careerfirst.lk/system/files/webform/cv/fondamentidichimicaschiavellopalmisanodownloadpdf.pdfIn PDF document text
    • https://www.parking.iastate.edu/system/files/webform/invehero436.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.