Malicious PDF — malware analysis report

Static analysis result for SHA-256 6852e72849c12335…

MALICIOUS

PDF

117.3 KB Created: 2022-07-02 23:19:54 +00:00 Authoring application: dionen (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 491b64089de31f1935e23ef4c416eb90 SHA-1: 74307fecf52150ac5a1c56988674a773478d87cc SHA-256: 6852e72849c123354f56bb804c7f363f07dc04a5eee670b543db5e95fbd9d816
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which point to cracked software. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to host malicious content. The presence of URLs like http://mydrugdir.com/drydock/ suggests a lure for potentially harmful downloads.

Machine Learning

  • Nyx PDF Classifier clean score 0.0119

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mydrugdir.com/drydock/?implemantation=houer.WjN4IFNhbXN1bmcgMmcgVG9vbCBDcmFjawWjN.ZG93bmxvYWR8dEozWTNsMFlueDhNVFkxTmpjM01UZ3hPSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/burrill.irony PDF link annotation
    • http://lovelyonadime.com/?p=1410In PDF document text
    • https://ig-link.com/vmware-vcenter-converter-standalone-4-3-torrent/In PDF document text
    • https://antiquesanddecor.org/fajront-u-sarajevu-pdf-exclusive-download/In PDF document text
    • https://keyandtrust.com/wp-content/uploads/2022/07/Renault_Can_Clip_Torrent_FULL-1.pdfIn PDF document text
    • https://xtc-hair.com/gorenje-wa-583-uputstvo-za-13https-scoutmails-com-index301-php-k-gorenje-wa-583-uputstvo-za-13/In PDF document text
    • https://solaceforwomen.com/hd-online-player-one-by-two-malayalam-dubbed-movie-fr/In PDF document text
    • http://gastro-professional.rs/uncategorized/hazrat-abdul-qadir-jilani-books-in-bangla-pdf-15-hot/In PDF document text
    • https://extremesound.ru/dasha-ls-model-mega-top-129311-127999/In PDF document text
    • https://tourismcenter.ge/wp-content/uploads/2022/07/MaxPayne3v10022patchcrack_BESTedREADNFOTHETA_Latest_Version.pdfIn PDF document text
    • https://www.scalping.es/wp-content/uploads/2022/07/Introduccion_Al_Derecho_1_Santiago_Lopez_Aguilar_Pdf_24.pdfIn PDF document text
    • https://www.afrogoatinc.com/upload/files/2022/07/ElFgV5BNNF8DjlTrLaPh_02_e9309246d17c5bf96f687060e0d5e0ee_file.pdfIn PDF document text
    • https://dailytimespro.com/wp-content/uploads/2022/07/waltal.pdfIn PDF document text
    • http://wp2-wimeta.de/renaultimmocodecalculatoriicrack-hot/In PDF document text
    • https://www.acvconsultoria.com/wp-content/uploads/2022/07/CRACK_Windows_7_Ultimate_Sp1_64_Bit_Lite_V9_By_Nil.pdfIn PDF document text
    • https://6v9x.com/wp-content/uploads/2022/07/niagnewl.pdfIn PDF document text
    • https://www.apokoronews.gr/advert/crack-no-cd-toy-story-2-rar-hot/In PDF document text
    • http://rydbergaren.se/wp-content/uploads/2022/07/yancalbu.pdfIn PDF document text
    • http://www.bevispo.eu/wp-content/uploads/2022/07/hyprotech_hysys_31_crack_free_14.pdfIn PDF document text
    • https://teupluchangaiper.wixsite.com/natoralperf/post/the-gods-must-be-crazy-3-torrent-download-linkIn PDF document text
    • https://emealjobs.nttdata.com/en/system/files/webform/ambimarg888.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.