Malicious PDF — malware analysis report

Static analysis result for SHA-256 79c7f64a95db02f7…

MALICIOUS

PDF

154.3 KB Created: 2022-07-05 16:42:47 +00:00 Authoring application: tanjem (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 69624b2b28f77cbe78ecb0814fe4ed50 SHA-1: 5f2b3858e803ad02b7d3d292927c8dd34473da56 SHA-256: 79c7f64a95db02f7f1dec6042f2baa1f5dea516a5daea056137690a6e2c7dbb9
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple heuristics indicating it is a lure for cracked software, directing users to various URLs. One heuristic specifically flags a link to an algorithmically-generated URL, suggesting a malicious intent to host malware or phishing content. The presence of numerous external URIs further supports this assessment. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.0067

Heuristics 4

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sitesworlds.com/fifties/rooney/snakeoil/tradtion/high.RmlmYSAyMgRml.ZG93bmxvYWR8Ylk3TVdzMk5ueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA?unfocused PDF link annotation
    • https://supplementaryeducationalservices.com/blog/index.php?entryid=3124In PDF document text
    • https://midpointtechnologygroup.com/sites/default/files/webform/Fifa-22_11.pdfIn PDF document text
    • https://mohacsihasznos.hu/advert/fifa-22-serial-number-and-product-key-crack-2022/In PDF document text
    • http://slovenija-lepa.si/wp-content/uploads/2022/07/Fifa_22-4.pdfIn PDF document text
    • https://mandarinrecruitment.com/system/files/webform/fifa-22_345.pdfIn PDF document text
    • https://www.saugus-ma.gov/sites/g/files/vyhlif1181/f/uploads/fy_2018_final_values.pdfIn PDF document text
    • https://suchanaonline.com/fifa-22-keygenerator-patch-with-serial-key-free-download-latest/In PDF document text
    • https://elearning.21.training/blog/index.php?entryid=4547In PDF document text
    • https://sandylaneestatebeachclub.com/wp-content/uploads/2022/07/scoshi.pdfIn PDF document text
    • https://blackiconnect.com/upload/files/2022/07/7PSPAduQN8weiReBWkkA_05_a36598ecc01b09d7a56278f9a4a1436b_file.pdfIn PDF document text
    • http://sinteg.cat/?p=4553In PDF document text
    • https://social.cybertecz.in/upload/files/2022/07/2H4gxTosjLpgCa6XExKB_05_a36598ecc01b09d7a56278f9a4a1436b_file.pdfIn PDF document text
    • https://nashvilleopportunity.com/fifa-22-crack-activation-code-lifetime-activation-code-winmac/In PDF document text
    • https://egypt-aquarium.com/advert/fifa-22-download/In PDF document text
    • https://www.reperiohumancapital.com/system/files/webform/felkafl56.pdfIn PDF document text
    • https://www.lemiesoftskills.com/wp-content/uploads/2022/07/Fifa_22_Serial_Key__3264bit_2022_New.pdfIn PDF document text
    • https://www.lmbchealth.com/advert/fifa-22-crack-full-version-torrent-activation-code-latest/In PDF document text
    • https://healthyimprovementsforyou.com/fifa-22-serial-number-with-full-keygen-free-pc-windows-latest/In PDF document text
    • https://wmich.edu/system/files/webform/Fifa-22_50.pdfIn PDF document text
    • https://cris.unu.edu/sites/cris.unu.edu/files/webform/devqynt777.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.