Malicious PDF — malware analysis report

Static analysis result for SHA-256 465aa99775c4b899…

MALICIOUS

PDF

80.5 KB Created: 2022-06-10 03:18:41 +02:00 Authoring application: janntaki (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 4b46619c17747665776c630eb5131e70 SHA-1: f0bd6fd7d2855a7b346044a2d5a6a1cbd508ea54 SHA-256: 465aa99775c4b899c93c54bdb66b59ed55cfc4ed66f29e9a08f19f93bbef6b8b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm that advertises cracked software and directs users to download files from various external URLs. The primary heuristic indicates a large number of external links, suggesting a malicious intent to redirect users to potentially harmful content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.2120

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/caffeic.digitalization/listening/polyps?ZWJvb2sgZmlsc2FmYXQgaWxtdSBwZGYgZG93bmxvYWQZWJ&sunless=schiavo&ZG93bmxvYWR8M015TWpaa1lYeDhNVFkxTkRjNE1EZzNPWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=immortalize PDF link annotation
    • http://www.naglobalbusiness.com/testimonial/adobe-acrobat-xi-pro-11-0-final-x-force/In PDF document text
    • https://clubnudista.com/upload/files/2022/06/mMVbnECxcnR9eoHd37aS_10_7db0373f2e24fde76083d242344ad175_file.pdfIn PDF document text
    • https://grandioso.immo/download-driver-bcd2000-windows-10/In PDF document text
    • https://connectingner.com/wp-content/uploads/2022/06/carpany.pdfIn PDF document text
    • https://nlegal.org/wp-content/uploads/2022/06/pearanse.pdfIn PDF document text
    • https://www.sedaguzellikmerkezi.com/adobe-acrobat-pro-dc-2019-021-20058-crack-with-activation-number-free-download/In PDF document text
    • https://www.academiahowards.com/wp-content/uploads/2022/06/hascha.pdfIn PDF document text
    • https://www.jatjagran.com/wp-content/uploads/Dying_Light_Update_V140RELOADEDepub_EXCLUSIVE.pdfIn PDF document text
    • http://numb-z.com/?p=5361In PDF document text
    • http://www.allaprossimafermata.it/wp-content/uploads/2022/06/Grigori_Grabovoi_Numberspdf_HOT.pdfIn PDF document text
    • https://portal.neherbaria.org/portal/checklists/checklist.php?clid=19429In PDF document text
    • https://www.pinio.eu/wp-content/uploads//2022/06/hayltale.pdfIn PDF document text
    • https://thenationalcolleges.org/wp-content/uploads/Eberick_V8_Gold_lumine_V4_hidros_V4_Qicad_V4__Win_Xp_7_E_8_F.pdfIn PDF document text
    • https://yemensouq.com/wp-content/uploads/2022/06/Solucionario_Fisica_Serway_7_Edicion_Vol_2_TOP.pdfIn PDF document text
    • http://pearlhmmph.com/wp-content/uploads/2022/06/Mali_Budo_Ceo_Film_Download_Torrent_Filme.pdfIn PDF document text
    • https://ecafy.com/kenwood-ham-radio-programming-software-crack-upd/In PDF document text
    • https://djolof-assurance.com/?p=10366In PDF document text
    • https://qflash.es/wp-content/uploads/2022/06/ferdas.pdfIn PDF document text
    • http://villa-mette.com/?p=13044In PDF document text
    • https://www.5etwal.com/tomtom-mapa-srbije-rapidsharel/In PDF document text
    • https://thenationalcolleges.org/wp-In PDF document text
    • http://pearlhmmph.com/wp-content/uploads/2022/06/mali_budo_ceo_film_download_torrent_filme.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000130d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x130D 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.