Malicious PDF — malware analysis report

Static analysis result for SHA-256 6790de0c73d38d07…

MALICIOUS

PDF

116.1 KB Created: 2022-07-08 01:48:11 +00:00 Authoring application: ellygemm (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: d988d57f9e5c17c024a70edbef432810 SHA-1: 53d5dc56ccf97254a4f0649e6a834855de7ad419 SHA-256: 6790de0c73d38d077cde4c20e26a1aef90c0b704682de2a81902bca428cb8a44
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, which primarily advertise cracked software. The primary URL, http://blogbasters.com/dmitri/unexpressed/horones.dGVsZWNoYXJnZXIgZ3JhdHVpdCBmYWNlYm9vayBoYWNrIHRvb2wgdjIuMwdGV?hyperthyroidism=ZG93bmxvYWR8aDZSWW5Ob2NYeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA&jurevicius=attentive/marel, is also suspicious and likely leads to a malicious payload. The document's purpose appears to be to trick users into downloading potentially harmful cracked software through a link farm.

Machine Learning

  • Nyx PDF Classifier clean score 0.0245

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blogbasters.com/dmitri/unexpressed/horones.dGVsZWNoYXJnZXIgZ3JhdHVpdCBmYWNlYm9vayBoYWNrIHRvb2wgdjIuMwdGV?hyperthyroidism=ZG93bmxvYWR8aDZSWW5Ob2NYeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA&jurevicius=attentive/marel
    • http://karnalketo.com/wp-content/uploads/2022/07/derephi.pdf
    • https://abckidsclub.pl/wp-content/uploads/2022/07/Virtual_DJ_Pro_Cracked_With_Registration_Code_Full_Version_F.pdf
    • https://okinawahousingportal.com/la-magie-de-voir-grand-david-schwartz-pdf-gratuit-hot/
    • https://www.cameraitacina.com/en/system/files/webform/feedback/acustica-audio-nebula-3-libraries-collection-2013.pdf
    • http://www.fiscalsponsor.net/wp-content/uploads/2022/07/NewBlue_TotalFX_5_BETTER_Crack.pdf
    • http://www.travelmindsets.com/?p=17151
    • https://kcmuslims.com/advert/virtuagirl-1-871-virtual-girl-crack-new/
    • http://www.filmwritten.org/?p=19752
    • https://socks-dicarlo.com/wp-content/uploads/2022/07/nornab.pdf
    • https://jobs.lluh.org/system/files/webform/leslmyth278.pdf
    • http://shoplidaire.fr/?p=160368
    • https://ruangilmu.id/wp-content/uploads/2022/07/download_usb_extreme_ps2_110.pdf
    • https://www.cameraitacina.com/en/system/files/webform/feedback/download-arkaos-grandvj-165-incl-crack.pdf
    • http://joshuatestwebsite.com/the-social-network-2-full-movie-in-hindi-hd-download-free-new/
    • https://flagonsworkshop.net/upload/files/2022/07/zR8hSPceYoQvt2s4TiWt_08_bb3716b0cceca9e5e61112fa8b5f1b31_file.pdf
    • https://trikonbd.com/zmodeler-2020-full-crack-with-license-key-version-full-setup-all-in-one-repack/
    • http://www.gurujijunction.com/blog/autocad-for-mac-2017-mac-os-x-cracked-macosx-cracked/
    • https://www.internshipsmalta.com/sites/default/files/webform/33-freeware-Karaoke-MP3-G-Toolz-Serial-Key-keygen.pdf
    • http://www.fiscalsponsor.net/wp-content/uploads/2022/07/newblue_totalfx_5_better_crack.pdf
    • https://trello.com/c/LRAddVgd/85-fsx-fsdreamteam-zurich-kloten-v25-link
    • https://norofmacupi.wixsite.com/vampaysteper::vampaysteper:2yshw4IrXq:norofmacupi@yahoo.com/post/david-tennant-doctor-who-christmas-specials-torrent-best
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.