Malicious PDF — malware analysis report

Static analysis result for SHA-256 83a6f5ced573e854…

MALICIOUS

PDF

142.2 KB Created: 2022-06-13 09:22:13 +02:00 Authoring application: osittal (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 4e24301e4f31d885496ff9dbdeceec30 SHA-1: 074abc6823223e69784513aeb4f283d80b724a21 SHA-256: 83a6f5ced573e854a6d21d0395a60860ed566a3c47684eea901f6dd98eeb0c31
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a significant number of external links, identified as a link farm. One of the primary URLs, http://evacdir.com/ZG93bmxvYWR8VHg4TVRWNFpYUjhmREUyTlRRNU9Ea3hOako4ZkRJMU56UjhmQ2hOS1NCeVpXRmtMV0pzYjJjZ1cwWmhjM1FnUjBWT1hR.comedysportz?chariot=dumpsite.knowledgeable.TnVlbmRvIDUuMS4xIFBvcnRhYmxlIFRvcnJlbnQgc2Nod2FuZ2VyIGpvc2h5IGFuZnITnV/desktops/, appears to be a download lure. The presence of numerous links suggests an attempt to distribute further malicious content or engage in SEO spam. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier clean score 0.0108

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/ZG93bmxvYWR8VHg4TVRWNFpYUjhmREUyTlRRNU9Ea3hOako4ZkRJMU56UjhmQ2hOS1NCeVpXRmtMV0pzYjJjZ1cwWmhjM1FnUjBWT1hR.comedysportz?chariot=dumpsite.knowledgeable.TnVlbmRvIDUuMS4xIFBvcnRhYmxlIFRvcnJlbnQgc2Nod2FuZ2VyIGpvc2h5IGFuZnITnV/desktops/
    • https://beta.pinoysg.net/upload/files/2022/06/V4JrYOnz5ajJSQvVlzDo_13_2b0531190060a0082903d4a5251f2aec_file.pdf
    • https://www.dejavekita.com/upload/files/2022/06/HXdd6k6gglZOHfdn11Xm_13_d2b54a9dd6b7c30f661501b326d2ad4b_file.pdf
    • https://gardeners-market.co.uk/advert/tamil-hd-movies-download-1080p-lingaa/
    • https://boiling-castle-64102.herokuapp.com/viguene.pdf
    • http://www.buzzthat.org/wowonder/upload/files/2022/06/AO4v6Ue84Ijontu74GPc_13_834bdbbf5663b3cc28b924e4be65dab6_file.pdf
    • https://attitude.ferttil.com/upload/files/2022/06/c91Z6wUAW6kP1gE82nbQ_13_0460504321511161c27049f1352fa282_file.pdf
    • https://xplicitnet.com/advert/judge-singh-punjabi-movie-hd-download-link/
    • https://technospace.co.in/upload/files/2022/06/qUdp9LX2qJkBhPs62JRQ_13_d2b54a9dd6b7c30f661501b326d2ad4b_file.pdf
    • https://kaalama.org/upload/files/2022/06/EXpAjEVJH2COBu2UfgyM_13_2b0531190060a0082903d4a5251f2aec_file.pdf
    • http://www.sonlinetutor.com/advert/bhrigu-samhita-kundli-software-download-hot/
    • https://wp.gymbruneck.info/advert/nathalie-la-petite-hotesse-15-verified/
    • https://www.fooos.fun/social/upload/files/2022/06/zp57JWkHkftYr64KrMq6_13_20654b5e88d39ccbe747121b3f8cb260_file.pdf
    • https://ictlife.vn/upload/files/2022/06/FsqsCsXr3tJFjuyeRsE5_13_0460504321511161c27049f1352fa282_file.pdf
    • https://intense-headland-05793.herokuapp.com/darkign.pdf
    • https://chickentowngazette.com/advert/thermo-multiskan-ascent-software-17-battlestar-distretto/
    • https://waoop.com/upload/files/2022/06/taHr7Ogeoa1ShBoFuuJM_13_f43d980ef6bdbee47c48fc388c9b8943_file.pdf
    • https://www.hajjproperties.com/advert/dddl-6-45-keygen/
    • http://classibox.wpbranch.com/advert/apple-imac/
    • https://social.wepoc.io/upload/files/2022/06/FNuwAsfffOBw2nAI7Z51_13_0460504321511161c27049f1352fa282_file.pdf
    • https://storage.googleapis.com/blacksnetwork/upload/files/2022/06/pK5VLAxU8rWkugnQ4y2S_13_834bdbbf5663b3cc28b924e4be65dab6_file.pdf
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000ebb.bin
a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEBB 120140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.