Malicious PDF — malware analysis report

Static analysis result for SHA-256 70a99da4d48e58c2…

MALICIOUS

PDF

137.8 KB Created: 2022-07-04 03:17:26 +00:00 Authoring application: meldkam (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 41fb1e4dd085ccfde1b2cc359b588b30 SHA-1: 2da93738752714006682e4dccbc24dfc83140706 SHA-256: 70a99da4d48e58c2d7f3f4b252d499cfd09a3a6e3285f0eb4408095e74f8533c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded URLs, many of which are associated with cracked or pirated software. The heuristic 'PDF_CRACKED_SOFTWARE_LURE' specifically identifies this pattern. The document's primary function appears to be acting as a link farm to direct users to potentially malicious websites, likely for financial gain or to distribute further malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://awarefinance.com/comments/miles/RnJlZSBXZWJzaXRlIERvd25sb2FkZXIRnJ/spurrier.comice.containers&sully=ZG93bmxvYWR8U2gwTlRCbmIzeDhNVFkxTmpnNU1qTTFNbng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA PDF link annotation
    • https://www.makehaven.org/system/files/webform/amaneel923.pdfIn PDF document text
    • https://queery.org/portable-asuite-crack-keygen-full-version-download/In PDF document text
    • https://meuconhecimentomeutesouro.com/wp-content/uploads/2022/07/Stretch_Squash.pdfIn PDF document text
    • https://cancuntourssale.com/wp-content/uploads/2022/07/Time_Keeper.pdfIn PDF document text
    • https://slitetitle.com/web-site-zapper-3-18-2-crack-free/In PDF document text
    • https://miraclestripbass.com/wp/advert/psybassyx-2-3-0-crack-torrent-download-3264bit/In PDF document text
    • https://www.raven-guard.info/epub-to-lit-converter-software-crack-free-for-windows-2022-new/In PDF document text
    • https://earthoceanandairtravel.com/wp-content/uploads/2022/07/A_Better_Switchboard.pdfIn PDF document text
    • http://www.atlanticracingcars.com/wp-content/uploads/2022/07/hanrec-1.pdfIn PDF document text
    • https://babelson.com/wp-content/uploads/2022/07/Freelock.pdfIn PDF document text
    • https://agendaprime.com/wp-content/uploads/2022/07/Gamespot_Crack_Download.pdfIn PDF document text
    • http://launchimp.com/wp-content/uploads/2022/07/Mortal_Kombat_Windows_Theme.pdfIn PDF document text
    • https://ancient-eyrie-94494.herokuapp.com/brooben.pdfIn PDF document text
    • https://movingbay.com/mask-surf-pro-crack-2022-new/In PDF document text
    • https://africakesse.com/pdf-encrypt-crack-torrent-latest-2022/In PDF document text
    • https://fotofables.com/portable-work-time-application-crack-pc-windows/In PDF document text
    • https://psychomotorsports.com/snowmobiles/28556-a2skype-crack-free-download-mac-win/In PDF document text
    • https://hanffreunde-braunschweig.de/list-in-line-editor-crack-free-3264bit-april-2022/In PDF document text
    • http://kiraimmobilier.com/?p=35882In PDF document text
    • https://marctherheiniginfu.wixsite.com/buimanamen/post/telnet-server-crack-torrent-activation-code-free-mac-winIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://marctherheiniginfu.wixsite.com/buimanamen/post/telnet-server-crack-torrent-activation-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000328e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x328E 84608 bytes
SHA-256: 375e3dd81b33e118c2755702b9fda8c8fb56327703dbd847ea42e731abe824e7
font_01_sfnt_off0000bac9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBAC9 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.