Malicious PDF — malware analysis report

Static analysis result for SHA-256 94735e00e8d4574f…

MALICIOUS

PDF

118.6 KB Created: 2022-07-03 08:41:42 +00:00 Authoring application: quansal (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 2a3d12996eb962ac7f6173a061103be0 SHA-1: b625d340ed1f4e5ecf7a795becb6d03792fd0356 SHA-256: 94735e00e8d4574f7a9bbefae5f9129a8864a917fa5408bfac6d9bf636762604
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a large number of external links, indicating a link farm or SEO manipulation tactic. One of the primary external links points to 'signforcover.com', which is suspicious. The document body is heavily obfuscated and does not provide clear textual lures, but the sheer volume of links suggests a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier clean score 0.0066

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://signforcover.com/youngsters.asis.references/ZG93bmxvYWR8M0tmYnpkdlozeDhNVFkxTmpjM01UZ3hPSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/curveballs.innovative.QWRvYmUgUHJlbWllcmUgUHJvIENDIDIwMjAgdjE0LjAuMS43MSB3aXRoIENyYWNrQWR.irises
    • https://www.townofnewbury.org/sites/g/files/vyhlif951/f/news/official_ate_results_5.10.2022.pdf
    • https://www.lr-fyzio.cz/wp-content/uploads/2022/07/Usb_All4onerar_VERIFIED.pdf
    • http://westghostproductions.com/?p=4684
    • http://www.sartorishotel.it/?p=37173
    • https://gf-tunenoe.dk/wp-content/uploads/2022/07/Mount_And_Blade_Warband_Sex_Modtrmdsf.pdf
    • https://www.myshareshow.com/upload/files/2022/07/qLzt8vMCMO3KDlM3RzOg_03_712dab618bbf22861cae6a0f105403ac_file.pdf
    • https://gurureviewclub.com/wp-content/uploads/2022/07/Mobile_Movies_Mp4_Twilight_Saga_Breaking_Dawn_Part_1_Hindi_Dubbed.pdf
    • https://wilsonvillecommunitysharing.org/crack-and-psa-date-validator-epub-repack/
    • https://taxi2b.social/upload/files/2022/07/RtZisauvE24HIkhH9VhF_03_712dab618bbf22861cae6a0f105403ac_file.pdf
    • http://it-labx.ru/?p=56965
    • https://theblinkapp.com/red-garrote-strangler/
    • http://findmallorca.com/4k-video-downloader-4-11-3-crack-with-keygen-free-2020-exclusive/
    • https://ceza.gov.ph/system/files/webform/resume/doctor-strange-english-telugu-dubbed-movie-torrent-free-download.pdf
    • https://empoweresports.com/valhalla-vintage-verb-keygen-hot-for-mac/
    • https://www.lisbonme.org/sites/g/files/vyhlif3366/f/pages/06.15.18_mdot_lisbon_schedule.pdf
    • https://wardlincoln.com/dreamup-v-1-3-3-7-download-pc-2021/
    • http://glass710.cl/?p=11292
    • https://www.savvytreats.com/system/files/webform/janjalo826.pdf
    • http://tlcme.org/2022/07/03/tally-erp-9-release-4-5-full-version-with-crack-free-download-in-utorrent-new/
    • https://www.dandrea.com.br/advert/eltima-usb-network-gate-8-1-2013-activator-6-mb/
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.