PDF static analysis report

Static analysis result for SHA-256 43647b66da91bb3a…

SUSPICIOUS

PDF

130.9 KB Created: 2022-07-02 09:22:30 +02:00 Authoring application: jamijaen (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: f2f7bd1302cdb1ee8f20ee11be2776b0 SHA-1: 93e54a5d07f3b622bbca8ea74c4e3153d8452c43 SHA-256: 43647b66da91bb3a15e16154eadcd2ffeafa9be09a0b90a93e02adcfe52ca346
34 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF document contains heuristics indicating it advertises cracked software, with multiple links pointing to such content. One prominent external URI, http://sitesworlds.com/rogerbeta/..., was extracted, likely serving as a download source for the advertised cracked software. The document body is heavily obfuscated and does not provide further context.

Machine Learning

  • Nyx PDF Classifier clean score 0.0197

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sitesworlds.com/rogerbeta/ZG93bmxvYWR8SkIyWWpWcGIzeDhNVFkxTmpjeE1qTXdOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/apostles/crooner/mechanisms.regal.rollerblades/pronounced/cmFzb29sYW4gbmFiaW5hIGFyYWJpYyBzb25nIGRvd25sb2FkcmF PDF link annotation
    • https://ancient-temple-27217.herokuapp.com/parnsuc.pdfIn PDF document text
    • http://brotherskeeperint.com/2022/07/hindi-medium-full-movie-in-indonesia-subtitle-download-extra-quality/In PDF document text
    • https://netgork.com/upload/files/2022/07/gyxEdwqIYzIDeLlFuB81_02_2d5f2d5bf7353380de0ca591ce1c82db_file.pdfIn PDF document text
    • https://bluesteel.ie/2022/07/02/metasploit-pro-offline-activation-file/In PDF document text
    • https://www.chiesacristiana.eu/2022/07/02/john-e-freund-s-mathematical-statistics-with-applications-7th-edition-pdf-pdf/In PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/marham394.pdfIn PDF document text
    • https://www.viizair.com/hirens-boot-dvd-152-restored-edition-v3-proteus-__exclusive__/In PDF document text
    • http://gurureviewclub.com/never-failed-me-yet-by-mthunzi-namba-24/In PDF document text
    • https://dogrywka.pl/hasp-usb-dongle-crack-install-cubase/In PDF document text
    • https://you.worldcruiseacademy.co.id/upload/files/2022/07/VDZ76zPis3RwR8tBzsbL_02_b452a43771de7ebd971a603ff3bf5aa0_file.pdfIn PDF document text
    • https://4hars.com/ek-tha-tiger-movie-tamil-dubbed-in-720p-repack/In PDF document text
    • https://doitory.com/paragon-ntfs-15-4-44-crack-mac-osx-portable/In PDF document text
    • https://www.brookfield.k12.ct.us/sites/g/files/vyhlif4196/f/pages/advocacy_letter_from_brookfield_public_schools.pdfIn PDF document text
    • https://searchaustralianjobs.com/wp-content/uploads/2022/07/rhino_5_keygen_by_f4cg_patch.pdfIn PDF document text
    • https://news.mtkenya.co.ke/advert/blessthefall-his-last-walk-link-full-album-zip/In PDF document text
    • https://pacific-savannah-80017.herokuapp.com/Code_level_b22_catia.pdfIn PDF document text
    • https://lacomfortair.com/planet-nomads-install-download-highly-compressed-rar/In PDF document text
    • https://juliewedding.com/buddha-mar-gaya-720p-hd-movie-download-workl/In PDF document text
    • https://attitude.ferttil.com/upload/files/2022/07/EKnYiSQ13jn2svAI3M99_02_21baa1658912edf79ee219d1541b86c8_file.pdfIn PDF document text
    • https://wmich.edu/system/files/webform/kassreg549.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000014b2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x14B2 132280 bytes
SHA-256: 7fac92f1dd5c6f39a886c13ffee507ede0a8283e98d1552d5616799896955480

Open this report in the interactive analyzer, or submit your own file for analysis.