Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c6c48229eedfe86…

MALICIOUS

PDF

125.1 KB Created: 2022-06-12 16:54:39 +02:00 Authoring application: darrcher (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 595ad60ac32fb073a3dd289bc167a140 SHA-1: bc3fcb2ed3e58dc5f6136fca6186e186316b2c0b SHA-256: 7c6c48229eedfe8662cfd29c19db232c3a14facd8c95a224e8d3d9829e879deb
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, suggesting a link farm designed to direct users to potentially malicious content or to manipulate search engine results. One of the extracted URLs, http://evacdir.com/backhealthpro/chkcpu/oozed.gadget.RG93bmxvYWQgSXpvdG9wZSBPem9uZSA1IEZyZWUgQ3JhY2tlZARG9.ghaghara/gusman?lgbt=ZG93bmxvYWR8TjRiYVdOamJIeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA, is particularly suspicious due to its structure and domain. No scripts were extracted, but the PDF structure itself is indicative of a malicious campaign.

Machine Learning

  • Nyx PDF Classifier clean score 0.0284

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/backhealthpro/chkcpu/oozed.gadget.RG93bmxvYWQgSXpvdG9wZSBPem9uZSA1IEZyZWUgQ3JhY2tlZARG9.ghaghara/gusman?lgbt=ZG93bmxvYWR8TjRiYVdOamJIeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA PDF link annotation
    • https://netafits.com/wp-content/uploads/2022/06/Coduri_Cs_16_Badboy_V42_13.pdfIn PDF document text
    • https://arseducation.com/wp-content/uploads/2022/06/Autodesk_AutoCAD_2010_Keygens_Only_XFORCE_3264bits_RH_Download_Pcbfdcm.pdfIn PDF document text
    • https://www.jesusnanak.com/upload/files/2022/06/QcRRcBo2kTvfFWAG3D17_12_60e26fadba8a096602f144ad9a6e5552_file.pdfIn PDF document text
    • https://2c63.com/wp-content/uploads/2022/06/Lite_Fire_Laser_Engraver_Software.pdfIn PDF document text
    • https://marketing6s.com/index.php/advert/hum-tum-full-movie-hd-1080p-subtitles-exclusive-free-3/In PDF document text
    • https://www.dandrea.com.br/advert/top-five-verified-cracked-pixelmon-servers/In PDF document text
    • https://noshamewithself.com/upload/files/2022/06/kVST1NYBGxJ1V1OSTEPS_12_bb66bed8128f437f1d78947125b19b65_file.pdfIn PDF document text
    • https://gogathr.live/upload/files/2022/06/Tu4yoLBZJWZyHWUE22SW_12_bb66bed8128f437f1d78947125b19b65_file.pdfIn PDF document text
    • http://www.pickrecruit.com/download-holiday-world-tycoon-2006-pc14-new/In PDF document text
    • https://coolbreezebeverages.com/8dioambientguitarkontaktbetter-download/In PDF document text
    • http://villa-mette.com/?p=19069In PDF document text
    • https://xn--xvaos-qta.net/wp-content/uploads/2022/06/Simple_Student_Card_Full_Crackl.pdfIn PDF document text
    • https://en-media.tv/advert/buku-manual-daihatsu-taruna-sehen-kasumi-knight-best/In PDF document text
    • https://firstamendment.tv/upload/files/2022/06/NsR7Bm1skFPcwK9Bir1k_12_bb66bed8128f437f1d78947125b19b65_file.pdfIn PDF document text
    • https://www.blackheadpopping.com/hwidchangerv18pcdownloadpc/In PDF document text
    • https://www.apbara.be/index.php/advert/outlive-game-download-full-version/In PDF document text
    • http://jwbotanicals.com/building-design-and-construction-vicente-tagayun-calamaro-cerberus-ll/In PDF document text
    • http://www.ndvadvisers.com/wp-content/uploads/2022/06/TruLaser_V2012_KEYGEN_XfKEYWORDkg_X64zip.pdfIn PDF document text
    • http://www.vxc.pl/wp-content/uploads/2022/06/Manual_Yamaha_5_BS_661.pdfIn PDF document text
    • https://marriagecermony.com/sociology-themes-and-perspectives-haralambos-and-holborn-michael-haralambos-epub/In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000011e4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11E4 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000bfc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFC7 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.