Malicious PDF — malware analysis report

Static analysis result for SHA-256 846b86b2bb15e39f…

MALICIOUS

PDF

111.7 KB Created: 2022-07-06 07:42:23 +00:00 Authoring application: gohalaw (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: d883ffa1075b2b828241aec43a221b10 SHA-1: a70a8f3447791659dcce067d95fd44f18a23d51a SHA-256: 846b86b2bb15e39f0d7e5b90b3922db9b3aeb983b09d8c13e484bc3a09e1d0ef
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains heuristics indicating it advertises cracked software and includes external URIs. One heuristic specifically mentions 'cmd.pdf' and a sequence that resembles command execution, suggesting a potential attempt to exploit system commands or download further payloads. The presence of multiple links to potentially malicious or unknown sites reinforces the lure for cracked software, which is a common tactic for malware distribution.

Machine Learning

  • Nyx PDF Classifier clean score 0.0201

Heuristics 4

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lehmanbrotherbankruptcy.com/asses/conditioning/ZG93bmxvYWR8YkI0WTJSbWRueDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/excercises/SEQgT25saW5lIFBsYXllciAodXRvcnJlbnQgZG93bmxvYWRkIGZyZWUgamFiIHRhayBoYWkgKQSEQ/feldspar/ PDF link annotation
    • https://lanave.es/wp-content/uploads/2022/07/Rosetta_Stone_347_Learn_English_ISO_15_Complete_Serial_Key_K.pdfIn PDF document text
    • https://enigmatic-peak-44803.herokuapp.com/polderbits_90_serial_taringa.pdfIn PDF document text
    • https://threepatrons.org/news/vxp-whatsapp-hot/In PDF document text
    • https://ekhayaonline.com/cleartone-cm-9000-pdf-download-_verified_/In PDF document text
    • https://guarded-journey-96704.herokuapp.com/hackercomptefacebookaveccmd.pdfIn PDF document text
    • http://barrillos.es/wp-content/uploads/2022/07/Euro_Truck_Simulator_13_LINK_Crack_Indir_Gezginler.pdfIn PDF document text
    • https://www.bywegener.dk/wp-content/uploads/2022/07/Cracking_The_Code_Third_Edition_Download.pdfIn PDF document text
    • https://thebrothers.cl/http-uploadsnack-c-om-nmtkm7-password-torrentdcus-1-top/In PDF document text
    • http://sssi.net/sites/default/files/webform/biregab661.pdfIn PDF document text
    • https://used-gensets.com/advert/download-powerdesigner-15-2-full-crack-hot/In PDF document text
    • https://viralcbds.com/wp-content/uploads/2022/07/TOP_Crack_GoldenSoftware_Voxler_V331843_With_Key_iahq76.pdfIn PDF document text
    • https://www.gayleatherbiker.de/upload/files/2022/07/QQX9oRZoTVqRfVSLw7Iv_06_d2d9c9528113745f643b225b03ca1c03_file.pdfIn PDF document text
    • https://zwergenburg-wuppertal.de/advert/autocad-electrical-2010-keygen-xforce-new/In PDF document text
    • https://www.digitalpub.ma/advert/realtek-rtl8187-wireless-lan-utility-windows-7-downloadl-exclusive/In PDF document text
    • https://boomingbacolod.com/brainsbreaker-5-activation-code-keygen-13-verified/In PDF document text
    • https://changehealthfit.cz/wp-content/uploads/2022/07/Mere_Brother_Ki_Dulhan_2011_720p_DVDRip_700MB.pdfIn PDF document text
    • http://prabhatevents.com/kmsauto-net-2016-1-5-3-full-crack-free/In PDF document text
    • https://sheltered-inlet-78551.herokuapp.com/haldeve.pdfIn PDF document text
    • https://www.gayleatherbiker.de/upload/files/2022/07/QQX9oRZoTVqRfVSLw7Iv_06_d2d9c9528113745f643b225b03ca1c0In PDF document text
    • http://barrillos.es/wp-content/uploads/2022/07/euro_truck_simulator_13_link_crack_indir_gezginler.pdfIn PDF document text
    • https://prepofanelIn macro / runtime command snippet
    • https://wakelet.com/wake/jGm_rCAj6S75t_qOh9BswIn PDF document text
    • https://prepofanelafur.wixsite.com/bullcomaros/post/hd-online-player-kamasutra-3d-full-movie-hd-download-_top_In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001057.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1057 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009843.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9843 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.