PDF static analysis report

Static analysis result for SHA-256 4c2990c0e41dd8fc…

SUSPICIOUS

PDF

170.8 KB Created: 2022-06-08 01:58:29 +02:00 Authoring application: indkiel (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 0866744dd31746764825018c2efc3700 SHA-1: 7c45122bf5aab0de576f410e65a3293728f2e24d SHA-256: 4c2990c0e41dd8fc0833b4a02206f766e16759c01217a4b379e6aa8d1fd1c8c9
34 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains multiple links advertising cracked software, indicating a lure to download potentially malicious applications. One of the extracted URLs, http://evacdir.com/churchgoers.biostatisticians/founded/litigated/ZG93bmxvYWR8dGoyTVhOcU5ueDhNVFkxTkRZME16TTFNSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/QWlyIFBob3RvIFNlcnZlcgQWl/, is particularly suspicious and likely serves as a download source for a second-stage payload. The presence of numerous cracked software links strongly suggests a malicious intent to trick users into downloading malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0054

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/churchgoers.biostatisticians/founded/litigated/ZG93bmxvYWR8dGoyTVhOcU5ueDhNVFkxTkRZME16TTFNSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/QWlyIFBob3RvIFNlcnZlcgQWl/ PDF link annotation
    • https://gecm.es/wp-content/uploads/2022/06/YouTube_For_TV_Crack__2022.pdfIn PDF document text
    • https://zindgilife.xyz/wp-content/uploads/2022/06/Caterpillar__With_License_Key.pdfIn PDF document text
    • https://gabonbiota.org/portal/checklists/checklist.php?clid=4829In PDF document text
    • https://cupcommunity.com/wp-content/uploads/2022/06/Mermaid_Preschool_Lessons.pdfIn PDF document text
    • https://travelwithme.social/upload/files/2022/06/dVDDnweQGUcdVRrgnl83_07_412b0c0d7a82f077ad709eb63e575522_file.pdfIn PDF document text
    • http://stroiportal05.ru/advert/rational-typist-free-april-2022/In PDF document text
    • https://l1.intimlobnja.ru/wp-content/uploads/2022/06/sort_mp3_crack_free_for_pc.pdfIn PDF document text
    • https://www.29chat.com/upload/files/2022/06/7ay23UjfTZaSiE2MTi8g_07_412b0c0d7a82f077ad709eb63e575522_file.pdfIn PDF document text
    • https://cch2.org/portal/checklists/checklist.php?clid=9772In PDF document text
    • https://pigeonrings.com/wp-content/uploads/2022/06/BasicTables_Crack_Torrent_For_PC_Updated2022.pdfIn PDF document text
    • https://teleo.es/upload/files/2022/06/LdBoPvq1rbwKLFsoDnpe_07_b2ee0869a09ba3f88ed796e4385348df_file.pdfIn PDF document text
    • https://bryophyteportal.org/portal/checklists/checklist.php?clid=12949In PDF document text
    • http://xn----8sbdbpdl8bjbfy0n.xn--p1ai/wp-content/uploads/2022/06/SysInfoTools_NSF_Merge_Crack_Patch_With_Serial_Key.pdfIn PDF document text
    • https://asu-bali.jp/wp-content/uploads/2022/06/Website_Mentor__Download_PCWindows_Final_2022.pdfIn PDF document text
    • https://fast-ravine-77588.herokuapp.com/celhon.pdfIn PDF document text
    • http://www.sataal.com/wp-content/uploads/2022/06/Overlay_Crack_Full_Version_Free_PCWindows.pdfIn PDF document text
    • https://booktoworm.com/wp-content/uploads/2022/06/promhali.pdfIn PDF document text
    • https://globalart.moscow/stil/font-matching-tool-crack/In PDF document text
    • https://warganesia.id/upload/files/2022/06/SqIeIeveToerjXh2RYb3_07_1d148c2a0ffe8f2e6a345b4dfd46732c_file.pdfIn PDF document text
    • http://www.sataal.com/wp-content/uploads/2022/06/overlay_crack_full_version_free_pcwindows.pdfIn PDF document text
    • https://monarch.calacademy.org/checklists/checklist.php?clid=4660In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_022_off00006d18.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6D18 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.