Malicious PDF — malware analysis report

Static analysis result for SHA-256 91fd17bc0d4d2662…

MALICIOUS

PDF

116.8 KB Created: 2022-07-08 01:21:23 +00:00 Authoring application: lauchad (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: a30aa306a40219c9567f7ca75619d870 SHA-1: 7251778dcd8088f315145956a7d285e1127a7643 SHA-256: 91fd17bc0d4d26626bc3bf55963f7e146d734a7e859cb2bba9692e9f833bd42f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a large number of external links, many of which are advertised as cracked software. One of the primary links, http://evacdir.com/chemises/nishayam/hexaniacinate/pleuritis/cumbria?ZG93bmxvYWR8SGsxWWpJM2VIeDhNVFkxTnpFNE5qazFOWHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=prfree&S3JhbnRpIDE5ODEgRHZEUmlwIHgyNjQgQUMgMyBNNzc3IE0yVHYS3J=, appears to be a malicious domain used for downloading payloads. The heuristic firings indicate a link farm designed to promote pirated software, suggesting a lure for users to download potentially malicious files.

Machine Learning

  • Nyx PDF Classifier clean score 0.0452

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/chemises/nishayam/hexaniacinate/pleuritis/cumbria?ZG93bmxvYWR8SGsxWWpJM2VIeDhNVFkxTnpFNE5qazFOWHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=prfree&S3JhbnRpIDE5ODEgRHZEUmlwIHgyNjQgQUMgMyBNNzc3IE0yVHYS3J= PDF link annotation
    • https://thehomeofheroes.org/easeus-data-recovery-12-8-crack-better-with-license-key-2019/In PDF document text
    • https://tutorizone.com/wp-content/uploads/2022/07/flawjard.pdfIn PDF document text
    • https://yooyi.properties/wp-content/uploads/2022/07/CounterStrike_Source_Zombie_Mod_New_Editmod_Serial_Key_Keyge.pdfIn PDF document text
    • https://moniispace.com/upload/files/2022/07/SsWwPnE5fEJZ1ymlGtvK_08_a0cdc7553e87234c6045ce1f177d3015_file.pdfIn PDF document text
    • http://www.studiofratini.com/pipeflow-expert-2007-rev-1-12-rar-2/In PDF document text
    • http://www.rathisteelindustries.com/wp-content/uploads/2022/07/osypan.pdfIn PDF document text
    • https://shielded-beyond-27101.herokuapp.com/freaelme.pdfIn PDF document text
    • https://immense-ridge-83997.herokuapp.com/napoleon_bonaparte_history_in_urdu_pdf_download.pdfIn PDF document text
    • https://salty-stream-77408.herokuapp.com/AUTODATA465CrackFULLUpdate2018.pdfIn PDF document text
    • https://ourlittlelab.com/wp-content/uploads/2022/07/Cobra_driver_Pack_2018_ISO_Cracked_Free_Download.pdfIn PDF document text
    • https://eqsport.biz/baca-novel-melayu-online-free-best/In PDF document text
    • https://fairosport.com/solucionarioresistenciadematerialesschaumwilliamnash/In PDF document text
    • https://lit-chamber-52114.herokuapp.com/illyvyvy.pdfIn PDF document text
    • https://boiling-tundra-30132.herokuapp.com/ysolat.pdfIn PDF document text
    • https://culvita.com/top-spin-1-pc-game-free-11-new/In PDF document text
    • http://www.reiten-scheickgut.at/wp-content/uploads/2022/07/HD_Online_Player_grau_gmbh_video_repair_tool_keygen_17.pdfIn PDF document text
    • http://oneteamacademy.com/wp-content/uploads/2022/07/Gp_Pro_Ex_Software_Free_Download.pdfIn PDF document text
    • https://yooyi.properties/wp-In PDF document text
    • https://moniispace.com/upload/files/2022/07/SsWwPnE5fEJZ1ymlGtvK_08_a0cdc7553e87234c6045ceIn PDF document text
    • https://ourlittlelab.com/wp-In PDF document text
    • http://www.reiten-scheickgut.at/wp-In PDF document text
    • http://www.reiten-scheickgut.at/wp-content/uploads/2022/07/hd_online_player_grau_gmbh_video_repair_tool_keygen_17.pdfIn PDF document text
    • https://wakelet.com/wake/Av2KhVu9p2vBAXmJByRCeIn PDF document text
    • https://trello.com/c/IY2mS6Aq/46-originlab-9-free-download-with-crack-repackIn PDF document text
    • https://trello.com/c/A1Yzv1BO/101-antrenand-o-pe-tessa-pdf-free-linkIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples