Malicious PDF — malware analysis report

Static analysis result for SHA-256 820bf46d98bf5ad9…

MALICIOUS

PDF

123.9 KB Created: 2022-07-05 08:24:44 +00:00 Authoring application: marcharr (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 555819f17bdfada2dc514f4d039aeb10 SHA-1: 596f4af1d7c0cb17633477512af4988f836d9591 SHA-256: 820bf46d98bf5ad93bc81b96247ac64c2dd60a59dafb5e658259ea3b21c07374
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are identified as advertising cracked software. The primary lure appears to be cracked versions of Adobe Photoshop. These links likely lead to malicious sites that host malware or exploit kits, aiming to compromise the user's system.

Machine Learning

  • Nyx PDF Classifier clean score 0.0236

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://awarefinance.com/director/purports/gotchas.spoofers=QWRvYmUgUGhvdG9zaG9wIDIwMjEgKFZlcnNpb24gMjIuNC4yKQQWR/ZG93bmxvYWR8dXowT1hKeE5IeDhNVFkxTmprNE1UVXdOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/
    • https://pacific-mesa-07010.herokuapp.com/akylann.pdf
    • http://campustoast.com/wp-content/uploads/2022/07/makinvi.pdf
    • https://vamaveche2mai.ro/wp-content/uploads/2022/07/Photoshop_2022_Version_231-1.pdf
    • https://searchaustralianjobs.com/wp-content/uploads/2022/07/Photoshop_CC_2019-1.pdf
    • https://elolist.com/wp-content/uploads/2022/07/latosha.pdf
    • https://excitevancouver.com/wp-content/uploads/2022/07/forskolf.pdf
    • http://ballyhouracampervanpark.ie/wp-content/uploads/2022/07/blaifre.pdf
    • https://www.ilistbusiness.com/wp-content/uploads/2022/07/Photoshop_CC_2015_Version_17_With_License_Key__Free_License_Key_For_PC.pdf
    • https://tbone.fi/wp-content/uploads/2022/07/Photoshop_2021_Crack_Mega__License_Keygen_Free_Download_Final_2022.pdf
    • https://majestic-biscayne-23624.herokuapp.com/Photoshop.pdf
    • https://mentalconnect.org/wp-content/uploads/2022/07/Adobe_Photoshop_2022_Updated.pdf
    • https://factspt.org/wp-content/uploads/2022/07/jongera.pdf
    • https://historic-great-basin-98621.herokuapp.com/Adobe_Photoshop_2021_Version_2251.pdf
    • https://secure-oasis-73235.herokuapp.com/Photoshop_CS4.pdf
    • https://murmuring-island-42762.herokuapp.com/chrval.pdf
    • https://osteocertus.com/wp-content/uploads/2022/07/Photoshop_2022_Version_232-1.pdf
    • https://calm-forest-84937.herokuapp.com/trevgha.pdf
    • https://everythingonevents.com/wp-content/uploads/2022/07/bilwoj.pdf
    • http://www.lesbianmommies.com/wp-content/uploads/2022/07/fabtalo.pdf
    • https://degrassi-inukshuk-77682.herokuapp.com/vibjav.pdf
    • https://www.ilistbusiness.com/wp-content/uploads/2022/07/Photoshop_CC_2015_Version_17_With_Li
    • https://tbone.fi/wp-content/uploads/2022/07/Photoshop_2021_Crack_Mega__License_Keygen_Free_D
    • https://trello.com/c/489F2Y8z/61-adobe-photoshop-cs3-download
    • https://titchwerbizpzorele.wixsite.com/liecechliapa/post/adobe-photoshop-2022-full-license-win-mac
    • https://trello.com/c/DaGBV6At/102-adobe-photoshop-cc-2015-patch-with-serial-key-download-updated
    • https://navigsale1984.wixsite.com/verbninvemi/post/adobe-photoshop-2021-version-22-4-1-hacked-keygen-full-version
    • https://trello.com/c/bIdEL5RK/115-adobe-photoshop-2022-version-2311
    • https://prodtisingkrathpar.wixsite.com/prinerpreqal/post/adobe-photoshop-2022-version-23-0-1-keygen-crack-serial-key-license-keygen-download
    • https://tantpanpeeraveta.wixsite.com/rassnessreken/post/adobe-photoshop-2022-with-license-key-pc-windows-latest
    • https://wakelet.com/wake/LsFBkDPiNgft-uBdb_l63
    • https://trello.com/c/rYbCtNhH/53-adobe-photoshop-2022-key-generator-license-code-keygen-updated-2022
    • http://www.tcpdf.org
    • https://trello.com/c/DaGBV6At/102-adobe-photoshop-cc-2015-patch-with-serial-key-download-
    • https://navigsale1984.wixsite.com/verbninvemi/post/adobe-photoshop-2021-version-22-4-1-hacked-
    • https://prodtisingkrathpar.wixsite.com/prinerpreqal/post/adobe-
    • https://tantpanpeeraveta.wixsite.com/rassnessreken/post/adobe-photoshop-2022-with-license-key-
    • https://trello.com/c/rYbCtNhH/53-adobe-photoshop-2022-key-generator-license-code-keygen-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/