Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ca9e226a4eb2130…

MALICIOUS

PDF

134.1 KB Created: 2022-06-12 17:15:15 +02:00 Authoring application: zyndzyg (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 7a24a1f575b0f8974c0261e53ff0eb50 SHA-1: c5dd206efd6f306293af6fa6d06159c602c120ac SHA-256: 8ca9e226a4eb213016e5c48ae328a3e38ee30e3364e01076d42a05de9634baec
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a significant number of external links, many of which point to other PDF files hosted on various domains, indicating a link farm designed to distribute malicious content. One heuristic specifically identified a PDF link to an algorithmically-generated URL, and another flagged a mass external PDF link farm. The embedded URLs suggest a distribution mechanism for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier clean score 0.0123

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/dulls/bedliner.cognex.distinctive/ZG93bmxvYWR8cFg3YVhKME1ueDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/illustrious/misbehavior/smacks/VHJvdmFudGUgRGlzY29ncmFmaWEgVG9ycmVudAVHJ/
    • https://www.techclipse.com/civil-3d-2009-32bit-product-key-and-xforce-keygen-rar-_hot_/
    • http://www.reiten-scheickgut.at/download-resident-evil-5-highly-compressed-12-mb/
    • https://b-labafrica.net/siedler-1-handbuch-pdf-31l/
    • https://comoemagrecerrapidoebem.com/wp-content/uploads/2022/06/heiwyli.pdf
    • https://concretolt.ro/advert/usb-dongle-backup-and-recovery-2012-download/
    • https://mentalconnect.org/wp-content/uploads/2022/06/Pilz_Pnozmulti_Configurator_EXCLUSIVE_Crack_Magazine_For_Ebay_Or_Amazon.pdf
    • https://expressionpersonelle.com/taal-full-movie-hd-720p-watch-online/
    • https://iamstudent.net/wp-content/uploads/2022/06/Hero_Editor_V_113_55_NEW.pdf
    • https://xn--wo-6ja.com/upload/files/2022/06/YbJB9bmEHEkpW14TnmiA_12_26da3f96454075803527e96210337509_file.pdf
    • https://thetopteninfo.com/wp-content/uploads/2022/06/Drivers_Windows_7_Packard_Bell_Alp_Horus_Gl.pdf
    • https://estatezone.net/wp-content/uploads/2022/06/Banglamovieonekshadhermoynafullmoviedownload.pdf
    • https://pouss-mooc.fr/2022/06/12/epson-adjustment-program-reset-l130-l220-l310-l360-l365-setup-free/
    • https://bymariahaugland.com/2022/06/12/revealer-keylogger-pro-edition-full-_top_-crack-27/
    • https://kjvreadersbible.com/wp-content/uploads/2022/06/IK_Multimedia_TRackS_CS_410_Keygen_By_Zuket_Creation_HOT.pdf
    • https://www.hypebunch.com/upload/files/2022/06/ZT5ANNYkpFVJw1cuqfmc_12_74b69002491786bc56f71cf86848eb63_file.pdf
    • http://viabestbuy.co/?p=13766
    • https://autodjelovicg.com/advert/roblox-speed-hack-script-pastebinl/
    • https://thenetworkcircle.com/wp-content/uploads/2022/06/Neethane_En_Ponvasantham_Full_Movie_Hd_1080p_Blu_Ray_Download.pdf
    • https://xn--80aagyardii6h.xn--p1ai/norwegian-wood-movie-eng-sub-download-film/
    • https://www.pickupevent.com/wp-content/uploads/2022/06/activation_crack_for_corel_draw_x4_16.pdf
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000e9d.bin
a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xE9D 120140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.