Malicious PDF — malware analysis report

Static analysis result for SHA-256 83cb94bfe36e546b…

MALICIOUS

PDF

126.6 KB Created: 2022-06-10 05:04:47 +02:00 Authoring application: dougell (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: cf20d64aa63c00f1227a5c725bca9160 SHA-1: 51774289d1b45b5d78730eaf73a1bcedabc86f18 SHA-256: 83cb94bfe36e546bfde8ec6260b42b47f295ff1487e423cd9b535f58930a5877
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, many of which advertise cracked or pirated software. The primary heuristic indicates a link farm designed to host external PDF files, suggesting a distribution mechanism for malicious content. The embedded URLs likely lead to further malicious downloads or phishing sites.

Machine Learning

  • Nyx PDF Classifier clean score 0.0284

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/dunlopillo/Q1JBQ0sgRnJlZSBZb3VUdWJlIERvd25sb2FkIDQuMS44MS43MjMgUHJlbWl1bSBGdWxsIFdpdGggTWVkaWNpbmVbQmFidQQ1J.hypertonic/failback/courses&ZG93bmxvYWR8SDhQTmpCcFlueDhNVFkxTkRjNE1EZzNPWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA?magazine&packards=shellmaker PDF link annotation
    • https://fraenkische-rezepte.com/windows-3-11-dos-boot-cd-hot/In PDF document text
    • https://social.urgclub.com/upload/files/2022/06/iDOSWp6H2Ph5aEzFksLL_10_c742b08cb3025b025cce9eb3b4505c31_file.pdfIn PDF document text
    • https://nixxcommerce.com/advert/thesims4v147491020dlcsselectablemulti17anadiusrepack-link/In PDF document text
    • https://footpathschool.org/wp-content/uploads/2022/06/Free_Download_NTSYS_Pc_For_Molecar_Biology_37_UPDATED.pdfIn PDF document text
    • http://duhocnewworld.com/wp-content/uploads/2022/06/siobgeor.pdfIn PDF document text
    • https://aapanobadi.com/2022/06/10/paragon-go-virtual-1-0-product-key-with-serial/In PDF document text
    • http://jaxskateclub.org/wp-content/uploads/2022/06/Ex4_To_Mq4_Decompiler_4_0_432_Free_download.pdfIn PDF document text
    • https://sarfatit.com/wp-content/uploads/2022/06/Teamviewer_1522756_For_Mac_OS.pdfIn PDF document text
    • https://ccsbe.org/wp-content/uploads/2022/06/preming.pdfIn PDF document text
    • https://inmueblesencolombia.com/?p=29008In PDF document text
    • https://fraenkische-rezepte.com/amok-krystian-bala-pdf-link/In PDF document text
    • http://mysquare.in/?p=13187In PDF document text
    • https://empoweresports.com/wp-content/uploads/2022/06/Summer_Lesson_Trick_for_PC__Gameoicom.pdfIn PDF document text
    • https://harringtonsorganic.com/currency-trading/ultimate-sound-bank-plugsound-box-vst-v1-92/In PDF document text
    • https://rodillosciclismo.com/wp-content/uploads/2022/06/amavan.pdfIn PDF document text
    • https://innovacioncosmetica.com/advanced-email-extractor-pro-v-2-76-with-serial/In PDF document text
    • https://chichiama.net/?p=39697In PDF document text
    • https://freecricprediction.com/wp-content/uploads/2022/06/Adobe_Audition_CC_2020_v130360_With_Crack_x64_Latest.pdfIn PDF document text
    • https://soundcollapse.altervista.org/advert/deep-hiarcs-14-uci-chess-engine-download-link/In PDF document text
    • https://fastdefocounlepoda.wixsite.com/ocordecki/post/carl-jung-an-introductionIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00001964.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1964 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000c747.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC747 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.