Malicious PDF — malware analysis report

Static analysis result for SHA-256 40ccb2e64473666b…

MALICIOUS

PDF

145.2 KB Created: 2022-07-05 19:16:18 +00:00 Authoring application: benecon (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 81b520147f50cbf559595357bc3b20b0 SHA-1: a390278744c1bcfec7071d030495ff1e49191fcf SHA-256: 40ccb2e64473666b4df157d945e0938b6567c5e095b9569dcc345db0ca27d00d
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are designed to appear as legitimate software download pages but actually lead to cracked software. The heuristic firings indicate a link farm specifically advertising pirated software, suggesting the primary goal is to redirect users to malicious or untrustworthy sites for illicit downloads. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.0059

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lehmanbrotherbankruptcy.com/confidant/garmin.firework/RmlmYSAyMgRml/ZG93bmxvYWR8OVVWTmpKcE1YeDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA&conquor=constancy PDF link annotation
    • https://logocraticacademy.org/fifa-22-crack-activation-code-3264bit/In PDF document text
    • https://www.mil-spec-industries.com/system/files/webform/Fifa-22_780.pdfIn PDF document text
    • http://capabiliaexpertshub.com/fifa-22-serial-number-and-product-key-crack-download-for-windows/In PDF document text
    • https://sissycrush.com/upload/files/2022/07/skIXotTKuPE4ZrNFA83j_05_5c3cc85c124dc165590d55017b7cc130_file.pdfIn PDF document text
    • https://www.interprys.it/wp-content/uploads/2022/07/Fifa_22_WinMac_2022.pdfIn PDF document text
    • https://bakicikibris.com/wp-content/uploads/2022/07/Fifa_22-4.pdfIn PDF document text
    • https://hissme.com/upload/files/2022/07/NuRtGv5og6x4PKObjuap_05_afda42f4ada9cbae3656e1e3886735a4_file.pdfIn PDF document text
    • https://supplementaryeducationalservices.com/blog/index.php?entryid=3202In PDF document text
    • https://websiteusahawan.com/2022/07/06/fifa-22-crack-with-serial-number-free-download-2022/In PDF document text
    • https://ksycomputer.com/fifa-22-keygen-generator-serial-number-full-torrent-free/In PDF document text
    • http://afrisource.org/?p=11811In PDF document text
    • http://nailsmerle.com/?p=20585In PDF document text
    • http://fisher65.ru/wp-content/uploads/2022/07/alassco.pdfIn PDF document text
    • https://livefitstore.in/advert/fifa-22-keygen-crack-serial-key-free-license-key/In PDF document text
    • https://humansofkarnataka.com/fifa-22-download-for-pc-latest-2/In PDF document text
    • https://community.tccwpg.com/upload/files/2022/07/RiakGPsvLUj8F2FUQdMq_05_eeea4344ccb1d510817db62d53dee59f_file.pdfIn PDF document text
    • https://axisflare.com/upload/files/2022/07/TlwHKcWhMoJbC1cAeEar_05_afda42f4ada9cbae3656e1e3886735a4_file.pdfIn PDF document text
    • https://mamawong.de/fifa-22-product-key-download-mac-win/In PDF document text
    • http://streetbazaaronline.com/?p=76301In PDF document text
    • http://capabiliaexpertshub.com/fifa-22-serial-number-and-product-key-crack-download-In PDF document text
    • https://sissycrush.com/upload/files/2022/07/skIXotTKuPE4ZrNFA83j_05_5c3cc85c124dcIn PDF document text
    • https://hissme.com/upload/files/2022/07/NuRtGv5og6x4PKObjuap_05_afda42f4ada9cbIn PDF document text
    • https://websiteusahawan.com/2022/07/06/fifa-22-crack-with-serial-number-free-In PDF document text
    • https://community.tccwpg.com/upload/files/2022/07/RiakGPsvLUj8F2FUQdMq_05_eeeaIn PDF document text
    • https://axisflare.com/upload/files/2022/07/TlwHKcWhMoJbC1cAeEar_05_afda42f4ada9cIn PDF document text
    • https://shadygrove.umd.edu/system/files/webform/Fifa-22_5.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text