PDF static analysis report

Static analysis result for SHA-256 41301e31ca1a8afc…

SUSPICIOUS

PDF

115.8 KB Created: 2022-07-02 15:56:45 +00:00 Authoring application: laumor (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 96b4f2922d40acb8a621c701137e8280 SHA-1: fb84e04815ef9571c81a0f0333efa1295aa5ec0f SHA-256: 41301e31ca1a8afc08824fd5e3ac3035691b4c70c71a8d6882427b8ad71e2ba5
34 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains heuristics indicating it is a lure for cracked software, with multiple embedded URLs pointing to sites advertising such content. One URL, in particular, appears to be a download link for a cracked software installer. The document body is heavily obfuscated and does not provide clear textual content for analysis.

Machine Learning

  • Nyx PDF Classifier clean score 0.0229

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sitesworlds.com/ZG93bmxvYWR8dGUxTW14d2QzeDhNVFkxTmpjM01UZ3hPSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.garment?bG9naXRyYWNlIHYxNCBjcmFjayBldCBzZXJpYWwuNDk4bG9=/revolved/biplanes/speall/oolong.unimpressed PDF link annotation
    • http://citizenrelocations.com/?p=2707In PDF document text
    • https://www.iltossicoindipendente.it/2022/07/02/mac-os-x-theme-for-windows-xp-download-link/In PDF document text
    • https://mysukishop.com/wp-content/uploads/2022/07/Serif_Pageplus_X7_Serial_Number-1.pdfIn PDF document text
    • http://match2flame.com/wp-content/uploads/2022/07/Kubo_1965_Statistical_Mechanics_Pdf_HOT.pdfIn PDF document text
    • https://www.carverma.gov/sites/g/files/vyhlif4221/f/uploads/septic_regs.2004.pdfIn PDF document text
    • https://www.lanesborough-ma.gov/sites/g/files/vyhlif761/f/uploads/img20200323_13184836.pdfIn PDF document text
    • http://berlin-property-partner.com/?p=28131In PDF document text
    • https://marriagefox.com/new-autocad-revit-lt-suite-2018-activation/In PDF document text
    • https://volektravel.com/wp-content/uploads/2022/07/Driver_Volante_Leadership_Gamer_Twin_Turbo_Download_Torrent_PATCHED.pdfIn PDF document text
    • https://printeleven.com/wp-content/uploads/2022/07/Freedom_Fighter_Crack_File_Exe-1.pdfIn PDF document text
    • http://mysquare.in/?p=35931In PDF document text
    • https://topnotchjobboard.com/system/files/webform/resume/como-configurar-omni-control-con-virtual-dj.pdfIn PDF document text
    • http://compasscarrier.com/warman-crack-with-full-game-__exclusive__/In PDF document text
    • https://www.realteqs.com/teqsplus/upload/files/2022/07/XOtOjmkiWnyVbu3ZjovW_02_42165a54c38bbbca09c95b0e604cac0b_file.pdfIn PDF document text
    • https://greenboxoffice.ro/wp-content/uploads/2022/07/Napro_Pc_Scan_2010_FULL_Crack.pdfIn PDF document text
    • https://rebatecircle.com/wp-content/uploads/2022/07/Main_Hoon_Na_3_Movie_In_Hindi_Free_Download_3gp.pdfIn PDF document text
    • http://buzhompro.com/?p=2016In PDF document text
    • http://boardingmed.com/?p=18963In PDF document text
    • https://www.apbara.be/index.php/advert/dyadem-pha-pro-8-download-patched/In PDF document text
    • https://www.engr.uky.edu/system/files/webform/billbet334.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples