Malicious PDF — malware analysis report

Static analysis result for SHA-256 820bf46d98bf5ad9…

MALICIOUS

PDF

123.9 KB Created: 2022-07-05 08:24:44 +00:00 Authoring application: marcharr (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 555819f17bdfada2dc514f4d039aeb10 SHA-1: 596f4af1d7c0cb17633477512af4988f836d9591 SHA-256: 820bf46d98bf5ad93bc81b96247ac64c2dd60a59dafb5e658259ea3b21c07374
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are identified as a 'link farm' advertising cracked software. One of the primary links points to a URL that hosts another PDF, suggesting a multi-stage lure. The presence of these links indicates an attempt to direct users to potentially malicious content or downloads.

Machine Learning

  • Nyx PDF Classifier clean score 0.0236

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://awarefinance.com/director/purports/gotchas.spoofers=QWRvYmUgUGhvdG9zaG9wIDIwMjEgKFZlcnNpb24gMjIuNC4yKQQWR/ZG93bmxvYWR8dXowT1hKeE5IeDhNVFkxTmprNE1UVXdOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/ PDF link annotation
    • https://pacific-mesa-07010.herokuapp.com/akylann.pdfIn PDF document text
    • http://campustoast.com/wp-content/uploads/2022/07/makinvi.pdfIn PDF document text
    • https://vamaveche2mai.ro/wp-content/uploads/2022/07/Photoshop_2022_Version_231-1.pdfIn PDF document text
    • https://searchaustralianjobs.com/wp-content/uploads/2022/07/Photoshop_CC_2019-1.pdfIn PDF document text
    • https://elolist.com/wp-content/uploads/2022/07/latosha.pdfIn PDF document text
    • https://excitevancouver.com/wp-content/uploads/2022/07/forskolf.pdfIn PDF document text
    • http://ballyhouracampervanpark.ie/wp-content/uploads/2022/07/blaifre.pdfIn PDF document text
    • https://www.ilistbusiness.com/wp-content/uploads/2022/07/Photoshop_CC_2015_Version_17_With_License_Key__Free_License_Key_For_PC.pdfIn PDF document text
    • https://tbone.fi/wp-content/uploads/2022/07/Photoshop_2021_Crack_Mega__License_Keygen_Free_Download_Final_2022.pdfIn PDF document text
    • https://majestic-biscayne-23624.herokuapp.com/Photoshop.pdfIn PDF document text
    • https://mentalconnect.org/wp-content/uploads/2022/07/Adobe_Photoshop_2022_Updated.pdfIn PDF document text
    • https://factspt.org/wp-content/uploads/2022/07/jongera.pdfIn PDF document text
    • https://historic-great-basin-98621.herokuapp.com/Adobe_Photoshop_2021_Version_2251.pdfIn PDF document text
    • https://secure-oasis-73235.herokuapp.com/Photoshop_CS4.pdfIn PDF document text
    • https://murmuring-island-42762.herokuapp.com/chrval.pdfIn PDF document text
    • https://osteocertus.com/wp-content/uploads/2022/07/Photoshop_2022_Version_232-1.pdfIn PDF document text
    • https://calm-forest-84937.herokuapp.com/trevgha.pdfIn PDF document text
    • https://everythingonevents.com/wp-content/uploads/2022/07/bilwoj.pdfIn PDF document text
    • http://www.lesbianmommies.com/wp-content/uploads/2022/07/fabtalo.pdfIn PDF document text
    • https://degrassi-inukshuk-77682.herokuapp.com/vibjav.pdfIn PDF document text
    • https://www.ilistbusiness.com/wp-content/uploads/2022/07/Photoshop_CC_2015_Version_17_With_LiIn PDF document text
    • https://tbone.fi/wp-content/uploads/2022/07/Photoshop_2021_Crack_Mega__License_Keygen_Free_DIn PDF document text
    • https://trello.com/c/489F2Y8z/61-adobe-photoshop-cs3-downloadIn PDF document text
    • https://titchwerbizpzorele.wixsite.com/liecechliapa/post/adobe-photoshop-2022-full-license-win-macIn PDF document text
    • https://trello.com/c/DaGBV6At/102-adobe-photoshop-cc-2015-patch-with-serial-key-download-updatedIn PDF document text
    • https://navigsale1984.wixsite.com/verbninvemi/post/adobe-photoshop-2021-version-22-4-1-hacked-keygen-full-versionIn PDF document text
    • https://trello.com/c/bIdEL5RK/115-adobe-photoshop-2022-version-2311In PDF document text
    • https://prodtisingkrathpar.wixsite.com/prinerpreqal/post/adobe-photoshop-2022-version-23-0-1-keygen-crack-serial-key-license-keygen-downloadIn PDF document text
    • https://tantpanpeeraveta.wixsite.com/rassnessreken/post/adobe-photoshop-2022-with-license-key-pc-windows-latestIn PDF document text
    • https://wakelet.com/wake/LsFBkDPiNgft-uBdb_l63In PDF document text
    • https://trello.com/c/rYbCtNhH/53-adobe-photoshop-2022-key-generator-license-code-keygen-updated-2022In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://trello.com/c/DaGBV6At/102-adobe-photoshop-cc-2015-patch-with-serial-key-download-In PDF document text
    • https://navigsale1984.wixsite.com/verbninvemi/post/adobe-photoshop-2021-version-22-4-1-hacked-In PDF document text
    • https://prodtisingkrathpar.wixsite.com/prinerpreqal/post/adobe-In PDF document text
    • https://tantpanpeeraveta.wixsite.com/rassnessreken/post/adobe-photoshop-2022-with-license-key-In PDF document text
    • https://trello.com/c/rYbCtNhH/53-adobe-photoshop-2022-key-generator-license-code-keygen-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EB3 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000b69f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB69F 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.