PDF static analysis report

Static analysis result for SHA-256 580bebba730e33f6…

SUSPICIOUS

PDF

116.3 KB Created: 2022-07-08 00:23:07 +00:00 Authoring application: verwha (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 09aff576203f18253b218768d282d100 SHA-1: b1f9dcea9ba447d2078f9d80991899c5cc851dee SHA-256: 580bebba730e33f67212225079a9787b34bac5c7c45e544b74a9382f43149474
34 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF document contains multiple heuristics indicating it is a lure for cracked software. It embeds external URIs pointing to domains that likely host malicious content or facilitate further downloads. The primary lure appears to be the advertisement of cracked software, directing users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier clean score 0.0187

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dawnloadonline.com/cults/chang/ZG93bmxvYWR8a2M1T1dwb2FueDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/discuses=fastrak/TWlyY2ggRnVsbCBIaW5kaSBNb3ZpZSBEb3dubG9hZATWl?directorship=mariagecounsel PDF link annotation
    • https://www.neoneslowcost.com/wp-content/uploads/2022/07/Smart_Choice_2_Workbook_Answer_Key_VERIFIED.pdfIn PDF document text
    • https://promwad.com/sites/default/files/webform/tasks/ellyele526.pdfIn PDF document text
    • https://social.deospace.com/upload/files/2022/07/rwFs4syRGVYkwujw28EE_08_1920961db50d16733a0d1fa56b88972c_file.pdfIn PDF document text
    • http://it-labx.ru/?p=66590In PDF document text
    • http://www.coneccta.com/2022/07/08/dilwale-dulhania-le-jayenge-movie-full-hd-1080p-free-download-extra-quality/In PDF document text
    • https://kramart.com/lets-explore-farm-junior-field-trips-torrent-top-full/In PDF document text
    • https://countymonthly.com/advert/sky-go-account-generator-_best_-cracked/In PDF document text
    • https://youfee.de/wp-content/uploads/2022/07/Cod_Mw3_Crack_Reloaded_17_BETTER.pdfIn PDF document text
    • https://okinawahousingportal.com/novissima-gramatica-ilustrada-sacconi-pdf-_hot_-download/In PDF document text
    • https://eastlakefc.com.au/sites/default/files/webform/cerekam236.pdfIn PDF document text
    • https://www.mil-spec-industries.com/system/files/webform/dedchev882.pdfIn PDF document text
    • http://www.camptalk.org/windows-server-2012-r2-kmspico/In PDF document text
    • https://www.dejavekita.com/upload/files/2022/07/rT1JIwc9yhEWLYRnjNcg_08_54e11a8dba9e26c0878b5a439cd7a9bc_file.pdfIn PDF document text
    • https://shoeytravels.com/wp-content/uploads/2022/07/chavyv.pdfIn PDF document text
    • https://www.town.hull.ma.us/sites/g/files/vyhlif3286/f/uploads/hull_parking_regulations_notice_for_2021.pdfIn PDF document text
    • https://greengrovecbd.com/blog/acrobat-pro-dc-base-hot-crack-update-2019-008-20071-oct-2018-hot-crack/In PDF document text
    • https://www.synergytherm.com/wp-content/uploads/2022/07/Download_Easy_Binder_20_UPD.pdfIn PDF document text
    • http://www.chelancove.com/cod2-mp-crack-new-1-3-downloadl/In PDF document text
    • https://farmaciacortesi.it/mathematica-10-keygen-ubuntu-mate-better/In PDF document text
    • https://disriatenmondbolsf.wixsite.com/iculazal/post/descargar-gratis-revistas-de-condorito-en-pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples