Malicious PDF — malware analysis report

Static analysis result for SHA-256 6efe902bd77116ed…

MALICIOUS

PDF

120.5 KB Created: 2022-07-03 13:44:53 +00:00 Authoring application: faitali (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 42e4570be9d25a4eca4088d23a9e8b50 SHA-1: 9ca0fb18792746270df04be5a354d9135652df54 SHA-256: 6efe902bd77116ed78d2069df8afa09a147d92d171040f7adeb1501573512378
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of external links, many of which are designed to lure users into downloading cracked software or other potentially malicious files. One notable URL is http://dormister.com/alds/ZG93bmxvYWR8NkFHZEdwbVozeDhNVFkxTmpjM01UZ3hPSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk?smith=/banners/malinchak/phenoms/Q2FsaWZvcm5pYSBEcml2ZXJzIExpY2Vuc2UgVGVtcGxhdGUgUGhvdG9zaG9wQ2F.klegon, which appears to be a download link. The presence of numerous SEO-optimized PDF links suggests a campaign to distribute malware or unwanted software.

Machine Learning

  • Nyx PDF Classifier clean score 0.0087

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dormister.com/alds/ZG93bmxvYWR8NkFHZEdwbVozeDhNVFkxTmpjM01UZ3hPSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk?smith=/banners/malinchak/phenoms/Q2FsaWZvcm5pYSBEcml2ZXJzIExpY2Vuc2UgVGVtcGxhdGUgUGhvdG9zaG9wQ2F.klegon
    • https://friendship.money/upload/files/2022/07/qDgDntpHj5qgz5ypW18V_03_57fa46ab30412b1930f2e03e0b781437_file.pdf
    • https://efekt-metal.pl/witaj-swiecie/
    • http://dottoriitaliani.it/ultime-notizie/alimentazione/alien-skin-eye-candy-7-2-2-20-x64-medicinebabupc-keygen-install/
    • https://boiling-cove-35993.herokuapp.com/Clinical_Pharmacy_Practice_Parthasarathy_Pdf_121.pdf
    • https://ferie-bolig.dk/creanga-de-aur-james-frazer-pdf-25-2021/
    • https://rednails.store/librecadhandbuchdeutschpdfdownload-repack/
    • https://www.pivatoporte.com/wp-content/uploads/2022/07/jazziany-1.pdf
    • https://ameeni.com/upload/files/2022/07/MP44kmRD5WQC8to548Nt_03_57fa46ab30412b1930f2e03e0b781437_file.pdf
    • http://yogaapaia.it/archives/31750
    • https://evonegocio.com/wp-content/uploads/2022/07/beryola.pdf
    • https://www.cbdorganics.mx/wp-content/uploads/2022/07/Rocscience_Rocplane_V2_029rarl.pdf
    • http://uttaranchalcollege.com/wp-content/uploads/2022/07/Sims_3_Crack_Alle_Erweiterungen_21.pdf
    • https://globe-med.com/crack-intuit-quickbooks-enterprise-18-0-r3-license-keyl-exclusive/
    • http://trabajosfacilespr.com/wp-content/uploads/2022/07/CRACK_ARTA_Audio_Measurement_And_Analysis_Software_V182_Incl_Keygen_PORTABLE.pdf
    • http://hotelthequeen.it/2022/07/03/the-filmmakers-guide-to-visual-effects-the-art-and-techniques-of-vfx-for-directors-producers-editors-and-cinematographers-verified-download-epub-mobi-pdf-fb2/
    • http://brainworksmedia.in/uncategorized/full-movie-the-legend-of-bhagat-singh-720p-__exclusive__/
    • http://imeanclub.com/?p=74081
    • https://k22.be/wp-content/uploads/2022/07/londerb.pdf
    • https://www.jomp.org/files/webform/financialaid/fayhana541.pdf
    • https://www.mcgill.ca/psychiatricgenetics/system/files/webform/ganymark584.pdf
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.