PDF static analysis report

Static analysis result for SHA-256 516eea28372c68a9…

SUSPICIOUS

PDF

139.2 KB Created: 2022-07-05 16:40:36 +00:00 Authoring application: weimchr (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: cc7c3d63e8758155b4ed32effa731ff0 SHA-1: 2cd524f87fbeef4283764a45353ddc8c31a86dd8 SHA-256: 516eea28372c68a97b5948f7943e8288c765038ff3ac87e997b7179ac08c5a66
34 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.001 Spearphishing Attachment T1071.001 Web Protocols

The PDF document contains heuristics indicating it advertises cracked software, a common lure for users to download malicious content. It embeds external URIs, with http://dormister.com/eggs/loginsfo.punkrock?iwach=ZG93bmxvYWR8OHhVTVdreWVueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.RmlmYSAyMgRml being a primary indicator of a potential download or redirection to a malicious site. The presence of multiple URLs related to cracked software further supports this attack pattern.

Machine Learning

  • Nyx PDF Classifier clean score 0.0056

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dormister.com/eggs/loginsfo.punkrock?iwach=ZG93bmxvYWR8OHhVTVdreWVueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.RmlmYSAyMgRml PDF link annotation
    • https://www.cranfordnj.org/sites/g/files/vyhlif436/f/uploads/certifiedcopyapplication.pdfIn PDF document text
    • https://www.paragon-europe.com/system/files/webform/berobel471.pdfIn PDF document text
    • https://techguye.com/fifa-22-nulled-for-windows-updated/In PDF document text
    • https://ithinksew.net/advert/fifa-22-free-3264bit-2022/In PDF document text
    • http://montehogar.com/?p=30111In PDF document text
    • https://horley.life/fifa-22-keygen-crack-setup-registration-code-free-x64-2022-new/In PDF document text
    • https://netgork.com/upload/files/2022/07/EwS744cfcXBMadSG2xCz_05_cab7f7ed935cfebc53da7f701e4234dc_file.pdfIn PDF document text
    • https://mahoganyrevue.com/advert/fifa-22-patch-full-version-download-april-2022/In PDF document text
    • http://purosautosdetroit.com/?p=32243In PDF document text
    • https://www.fermactelecomunicaciones.com/wp-content/uploads/2022/07/janrev.pdfIn PDF document text
    • https://dunstew.com/advert/fifa-22-crack-exe-file-latest/In PDF document text
    • https://alessiocarlino.it/wp-content/uploads/2022/07/Fifa_22.pdfIn PDF document text
    • http://rastaan.com/?p=10334In PDF document text
    • https://sbrelo.com/upload/files/2022/07/P9BHwosD7Pt6hSbZoIin_05_2c0f42895dc4c60a18e19b1540a235a0_file.pdfIn PDF document text
    • https://aswitte.de/sites/default/files/webform/uploads/efrwain353.pdfIn PDF document text
    • https://clasificadostampa.com/advert/fifa-22-activation-key-free-april-2022/In PDF document text
    • https://www.pianosix.com/fifa-22-universal-keygen-2022-new/In PDF document text
    • https://aalcovid19.org/fifa-22-crack-activation-code-product-key-for-windows/In PDF document text
    • https://arlingtonliquorpackagestore.com/fifa-22-hacked/In PDF document text
    • https://gardenlocked.com/upload/files/2022/07/eyctQE13oLvd1eGVJlWu_05_cab7f7ed935cfebc53da7f701e4234dc_file.pdfIn PDF document text
    • https://www.cranfordnj.org/sites/g/files/vyhlif436/f/uploads/certifieIn PDF document text
    • https://www.paragon-In PDF document text
    • https://horley.life/fifa-22-keygen-crack-setup-registration-code-free-In PDF document text
    • https://netgork.com/upload/files/2022/07/EwS744cfcXBMadSG2xCzIn PDF document text
    • https://mahoganyrevue.com/advert/fifa-22-patch-full-version-In PDF document text
    • https://www.fermactelecomunicaciones.com/wp-In PDF document text
    • https://sbrelo.com/upload/files/2022/07/P9BHwosD7Pt6hSbZoIin_0In PDF document text
    • https://aswitte.de/sites/default/files/webform/uploads/efrwain353.pIn PDF document text
    • https://clasificadostampa.com/advert/fifa-22-activation-key-free-In PDF document text
    • https://aalcovid19.org/fifa-22-crack-activation-code-product-key-In PDF document text
    • https://gardenlocked.com/upload/files/2022/07/eyctQE13oLvd1eGIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.