Malicious PDF — malware analysis report

Static analysis result for SHA-256 8734101d13a7e4ee…

MALICIOUS

PDF

139.5 KB Created: 2022-07-05 19:41:19 +00:00 Authoring application: orrylisa (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 99e4c522016117697260bcd115955100 SHA-1: 72cf649a369d2a420b93bc00f5690359a6ba4817 SHA-256: 8734101d13a7e4eef5bd52c80e84aedddbd0a41f4970e8ccc11bff6f42387ab9
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are associated with advertising cracked software. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external link farm, and 'PDF_CRACKED_SOFTWARE_LURE' confirms the nature of some of these links. The primary purpose appears to be directing users to potentially malicious websites for software piracy, which could lead to further malware infection.

Machine Learning

  • Nyx PDF Classifier clean score 0.0104

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestentrypoint.com/carotidynia/?RmlmYSAyMgRml=hamann&nairu=/mountain/ZG93bmxvYWR8dUUyTm5WaU5YeDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/holdouts PDF link annotation
    • https://kurditi.com/upload/files/2022/07/kNJvtN3OSOUWiBHczKrO_05_7ff7b908c43f79768ff6e8cafbdba0b6_file.pdfIn PDF document text
    • https://thehomeofheroes.org/fifa-22-crack-mega-pc-windows/In PDF document text
    • https://ikcasino.com/2022/07/05/fifa-22-hacked-activation-key-free/In PDF document text
    • https://alafdaljo.com/fifa-22-serial-number-for-windows/In PDF document text
    • https://asiccareer.com/wp-content/uploads/2022/07/wilyar-1.pdfIn PDF document text
    • https://greatriverfamilypromise.org/fifa-22-crack-patch-free-download-win-mac-april-2022/In PDF document text
    • http://dottoriitaliani.it/ultime-notizie/bellezza/fifa-22-keygen-with-product-key-download-march-2022/In PDF document text
    • https://cromaz.com.br/upload/files/2022/07/THViHQb2jqHMUq2gC85l_05_0b3c9f7204ac680ff1b8bae8988bd3a6_file.pdfIn PDF document text
    • https://shalamonduke.com/fifa-22-key-generator/In PDF document text
    • https://churchillcat.com/wp-content/uploads/2022/07/Fifa_22_HACK__.pdfIn PDF document text
    • http://chat.xumk.cn/upload/files/2022/07/7LlM17M41FC4R32jvfAP_05_0b3c9f7204ac680ff1b8bae8988bd3a6_file.pdfIn PDF document text
    • https://coetal.uog.edu.gy/sites/default/files/webform/ysaanno835.pdfIn PDF document text
    • https://firmateated.com/2022/07/05/fifa-22-hacked-with-keygen-2022/In PDF document text
    • http://vietnam-tourism-travel.com/fifa-22-jb-keygen-exe-3264bit-2022/In PDF document text
    • https://www.valenciacfacademyitaly.com/2022/07/05/fifa-22-keygen-only-serial-key-free-download-3264bit-latest-2022/In PDF document text
    • https://silkfromvietnam.com/fifa-22-hacked-free-download/In PDF document text
    • https://biomolecular-lab.it/fifa-22-2/In PDF document text
    • https://greenboxoffice.ro/fifa-22-lifetime-activation-code-pc-windows/In PDF document text
    • https://kurditi.com/upload/files/2022/07/kNJvtN3OSOUWiBHczIn PDF document text
    • https://ikcasino.com/2022/07/05/fifa-22-hacked-activation-In PDF document text
    • https://asiccareer.com/wp-In PDF document text
    • https://greatriverfamilypromise.org/fifa-22-crack-patch-free-In PDF document text
    • http://dottoriitaliani.it/ultime-notizie/bellezza/fifa-22-keygen-In PDF document text
    • https://cromaz.com.br/upload/files/2022/07/THViHQb2jqHMUIn PDF document text
    • https://churchillcat.com/wp-In PDF document text
    • http://chat.xumk.cn/upload/files/2022/07/7LlM17M41FC4R32jIn PDF document text
    • https://coetal.uog.edu.gy/sites/default/files/webform/ysaannoIn PDF document text
    • https://firmateated.com/2022/07/05/fifa-22-hacked-with-In PDF document text
    • http://vietnam-tourism-travel.com/fifa-22-jb-keygen-In PDF document text
    • https://www.valenciacfacademyitaly.com/2022/07/05/fifa-22-In PDF document text
    • https://greenboxoffice.ro/fifa-22-lifetime-activation-code-pc-In PDF document text
    • https://socialspace.ams3.digitaloceanspaces.com/upload/files/2022/07/aINQLxZGuYrj4ZMLpPjb_05_0b3c9f7204ac680ff1b8bae8988bd3a6_file.pdfIn PDF document text
    • https://wmich.edu/system/files/webform/Fifa-22_198.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://socialspace.ams3.digitaloceanspaces.com/upload/filesIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006961.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6961 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000f14d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF14D 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261