Malicious PDF — malware analysis report

Static analysis result for SHA-256 45ce87093bb0123d…

MALICIOUS

PDF

125.1 KB Created: 2022-06-09 22:54:52 +02:00 Authoring application: flanmor (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 31faad84c94f412eead90184b269e4b0 SHA-1: 2d40732f9ded76c7eefcff3bb32293c43e67071a SHA-256: 45ce87093bb0123d2b61bcf699333a04538dedc48c7a1afe3a769083d8ee2f78
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple heuristics indicating it advertises cracked software and links to external URLs. The presence of these links suggests an attempt to lure users into downloading potentially malicious software or visiting compromised sites. No scripts were extracted, but the document's primary function appears to be a lure for cracked software downloads.

Machine Learning

  • Nyx PDF Classifier clean score 0.0203

Heuristics 4

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/holben/bark/VmNlIDIuOC4xIENyYWNrZWQgVmVyc2lvbgVmN.fiddling/frankincense.hera.rebrika.ZG93bmxvYWR8SXUxWm1Kc01YeDhNVFkxTkRjNE1EYzROM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.flourishes PDF link annotation
    • http://www.bayislistings.com/prototype-3-free-download-pc-game-full-version-free/In PDF document text
    • https://deardigitals.com/portable-ecusafe-3-0-link/In PDF document text
    • https://festivaldelamor.org/solucionariotermodinmicakurtcrolle/In PDF document text
    • http://www.vidriositalia.cl/?p=6192In PDF document text
    • https://community.soulmateng.net/upload/files/2022/06/ND6XzXZOaeCo479IGsOv_09_4e65aee78075fcb03aa489a9ce8c6e2c_file.pdfIn PDF document text
    • https://www.arunachalreflector.com/2022/06/09/descargar-crack-work-pc-futbol-2001-iso/In PDF document text
    • http://www.reiten-scheickgut.at/work-full-intermediate-accounting-solutions-empleo-and-robles-vol-1-adds-107/In PDF document text
    • https://social.cybertecz.in/upload/files/2022/06/QkXemkOfGZleTUaEugD1_09_92a472654ef4bf1acdd6d1a4554d56a7_file.pdfIn PDF document text
    • https://rebuys.net/enter-u237-usb-tv-tuner-stick-driver-upd/In PDF document text
    • http://www.astrojan.nl/mijn-dagelijkse-links/In PDF document text
    • https://workschool.ru/upload/files/2022/06/aS4JckYFMBZZej6xZQR4_09_92a472654ef4bf1acdd6d1a4554d56a7_file.pdfIn PDF document text
    • https://www.riseupstar.com/upload/files/2022/06/FTJR8Ca2ma3KuoH7OWZq_09_92a472654ef4bf1acdd6d1a4554d56a7_file.pdfIn PDF document text
    • https://x-streem.com/upload/files/2022/06/dYk23iQncTSdgSK51FFq_09_4e65aee78075fcb03aa489a9ce8c6e2c_file.pdfIn PDF document text
    • http://practicea.com/?p=5087In PDF document text
    • https://lanoticia.hn/advert/kabah-omar-shareef-khatam-ghousia-khatam-dua-tu-hota-tahqiq-e-islami/In PDF document text
    • https://inobee.com/upload/files/2022/06/gBnJqPyikFOTgZdHcJLh_09_4e65aee78075fcb03aa489a9ce8c6e2c_file.pdfIn PDF document text
    • https://thoitranghalo.com/2022/06/09/mega-trainer-experience-premium-crack/In PDF document text
    • http://realtorforce.com/sniper-elite-v2-free-download-full/In PDF document text
    • https://luxurygamingllc.com/heat-and-mass-transfer-by-ds-kumar-pdf-371-upd/In PDF document text
    • https://weeginitisire.wixsite.com/bioracgita/post/downloadbukupengantarpendidikanpdf-portableIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000013e5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13E5 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.