Malicious PDF — malware analysis report

Static analysis result for SHA-256 802db895e932600a…

MALICIOUS

PDF

119.2 KB Created: 2022-07-08 05:39:20 +00:00 Authoring application: thoendr (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: f92ec327fb969dbb8e40fea315a13530 SHA-1: fc596cadf82eca878df3cb0790ec64b73bacbe92 SHA-256: 802db895e932600a08579a55365062cdefdefff91d616f06fd20d9af6f3eed08
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a heuristic firing for a 'PDF_SEO_LINK_FARM', indicating a large number of embedded external links. One of these links, http://thedirsite.com/calestous/..., appears to be a download URL. The document body is heavily obfuscated and unreadable, suggesting an attempt to hide malicious content. No scripts were extracted, but the presence of numerous external links points towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0374

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thedirsite.com/calestous/ZG93bmxvYWR8aGYxYUdKaE5YeDhNVFkxTnpFNE5qazFOWHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/determinants.c3RldmVuIHNsYXRlIGRydW1zIDQuMCB2c3QgdG9ycmVudAc3R/eggleston.giocastro.subprime/sages.imbeds PDF link annotation
    • http://www.vxc.pl/?p=43990In PDF document text
    • http://www.nra.gov.sl/system/files/webform/lyvophr442.pdfIn PDF document text
    • https://geobook.ge/advert/programmator-for-panasonic-kx-ta308-hot-crack/In PDF document text
    • https://bookland.ma/2022/07/08/hot-door-cadtools-11-2-2-for-adobe-illustrator-win-x64/In PDF document text
    • https://shi-id.com/password-southern-charms-hot/In PDF document text
    • https://social.maisonsaine.ca/upload/files/2022/07/73oGRCOceM5PjRjbqmTN_08_4b9684610d848ccf627199fa57227c8a_file.pdfIn PDF document text
    • https://colegioalbertsonsslp.com/wp-content/uploads/2022/07/Ghost_Bus_Hong_Kong_Movie_Download_VERIFIED-1.pdfIn PDF document text
    • http://www.gnvlearning.id/?p=10890In PDF document text
    • https://bluesteel.ie/2022/07/08/full-cracked-xunlei-thunder-portable/In PDF document text
    • https://www.modero.be/sites/modero.be/files/webform/complaints/full-beat-kangz-beat-thang-virtual-blp.pdfIn PDF document text
    • https://thecubanhouses.com/wp-content/uploads/2022/07/Statik_Ve_Mukavemet_Mehmet_Omurtag_Pdf_40_HOT.pdfIn PDF document text
    • https://cryptic-taiga-57291.herokuapp.com/Red_Giant_Trapcode_Suite_1518_Serial_Number_FREE_Download.pdfIn PDF document text
    • http://infoimmosn.com/?p=18619In PDF document text
    • https://inmueblesencolombia.com/?p=71139In PDF document text
    • https://vietnamnuoctoi.com/upload/files/2022/07/S6tk4EANTiiEcjPEsJsJ_08_f065174900f5301dd7b8e970387b0d31_file.pdfIn PDF document text
    • http://jwmarine.org/skruen-uden-ende-teknologihistor/In PDF document text
    • https://xcconcepts.com/wp-content/uploads/2022/07/Defense_Of_The_Ancients_Download_Full_Version_TOP.pdfIn PDF document text
    • https://purosautosdetroit.com/2022/07/08/2011-natale-in-sud-africa-2021-download-utorrent-ita/In PDF document text
    • https://brinke-eq.com/advert/big-fish-audio-suite-grooves-2-27/In PDF document text
    • https://social.maisonsaine.ca/upload/files/2022/07/73oGRCOceM5PjRjbqmTN_08_4b9684610d848ccfIn PDF document text
    • https://colegioalbertsonsslp.com/wp-In PDF document text
    • https://www.modero.be/sites/modero.be/files/webform/complaints/full-beat-kangz-beat-thang-virtual-In PDF document text
    • https://thecubanhouses.com/wp-In PDF document text
    • https://cryptic-In PDF document text
    • https://vietnamnuoctoi.com/upload/files/2022/07/S6tk4EANTiiEcjPEsJsJ_08_f065174900f5301dd7b8e9In PDF document text
    • https://xcconcepts.com/wp-In PDF document text
    • https://friend007.com/upload/files/2022/07/KZ1jmpmkfTfENy3UpYst_08_4b9684610d848ccf627199fa57227c8a_file.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://friend007.com/upload/files/2022/07/KZ1jmpmkfTfENy3UpYst_08_4b9684610d848ccf627199faIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002612.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2612 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000adfe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xADFE 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.