PDF malware analysis — malicious · 60e41f27463c3d4f

MALICIOUS

PDF

119.1 KB Created: 2022-07-08 05:22:28 +00:00 Authoring application: berwjal (via PDF Master 1.0.1) First seen: 2022-07-15

MD5: 611249aab6eea781cc7fe6e6511addd0 SHA-1: a775dbdba17ad3fd8c6d1e9114625a92bee9020d SHA-256: 60e41f27463c3d4f139e5c1f0c2e0980c513ea0a9931d48c41fdcb05417999cc

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document contains a significant number of external links, a technique often used for SEO poisoning or to distribute malicious content. The presence of a PDF_URI heuristic firing indicates an attempt to direct users to external resources. While no scripts were explicitly extracted, the PDF structure and the high volume of links suggest a malicious intent to redirect users to potentially harmful websites or downloads.

Machine Learning

Nyx PDF Classifier clean score 0.0152

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://thedirsite.com/c3VwYSBzdHJpa2FzIGNvbWljIHBkZiBkb3dubG9hZAc3V/whhhole/heinemann/ZG93bmxvYWR8YjlIWjNkcE9YeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.mantel.eden.morsel/
- http://www.teploobmenka.ru/advert/teploobmennik-titanovyj/
- https://www.oldlyme-ct.gov/sites/g/files/vyhlif3616/f/uploads/application_burn_permit.pdf
- http://tutorialspointexamples.com/descargar-ripoutoffice-2010-upd
- https://technospace.co.in/upload/files/2022/07/wueqYFu1jiXRcHUynvLh_08_e81e81ad81903566bdb5b3bfee50546d_file.pdf
- https://www.realvalueproducts.com/sites/realvalueproducts.com/files/webform/farcry3englishlanguagepack.pdf
- https://popstay.info/upload/files/2022/07/UHZ5MW9I1GPuJFLvPhAP_08_e81e81ad81903566bdb5b3bfee50546d_file.pdf
- http://www.mtdigroup.com/system/files/webform/cv/eset-nod32-antivirus-v1101540-final-license-finder-sh-utorrent.pdf
- https://smartbizad.com/advert/aiseesoft-converter-registration-code-link/
- https://med-smi.com/��-��/
- https://halalkitchenrun.com/wp-content/uploads/2022/07/Aki_Ola_Mathematics_For_Jhs_Pdf_38.pdf
- http://www.midax.it/registrazione-utenti/
- https://www.pickupevent.com/multiloader-v-5-65-by-taylorhwww-corby2new-downloads-com-exe/
- https://www.flyerbee.com/the-mere-dad-ki-maruti-movie-download-in-hindi-720p-free/
- https://vizitagr.com/eassos-partitionguru-3-7-0-free-portable-install/
- https://seoburgos.com/begegnungen-a1-schubert-verlag-pdf-top/
- https://1w74.com/pvsyst-6-activation-code-45-free/
- https://bhatimindcare.com/wp-content/uploads/2022/07/Download_free_ebooks_online_for_kobo_The.pdf
- http://pariswilton.com/wp-content/uploads/2022/07/kaflamf.pdf
- https://himoin.com/upload/files/2022/07/aANcYW14HD6GHDUtTr4u_08_14aa7c3d7de7b705089a179ff5dbcd4c_file.pdf
- https://technospace.co.in/upload/files/2022/07/wueqYFu1jiXRcHUynvLh_08_e81e81ad81903566bdb5b3bfee50546d_fil
- https://med-smi.com/��-��/
- http://morstenpoi.yolasite.com/resources/Digital-Pipe-Fitter-Keygen-LINK.pdf
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.