Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d3b527acfb0f5ce…

MALICIOUS

PDF

140.0 KB Created: 2022-07-05 19:01:17 +00:00 Authoring application: marchail (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 57105c802834a7fd543f5618bc9aef10 SHA-1: 71c3ece1aa3a66d4351c177233532ef8cac4cdd4 SHA-256: 9d3b527acfb0f5ce3907eed822f5773e710daed4b4cbdcd80a7c13e56170e898
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO poisoning tactic. One of the embedded URIs, http://emailgoal.com/wing/herding/bartending.beause?lizards=RmlmYSAyMgRml&&ZG93bmxvYWR8dlM5TlcxbWQzeDhNVFkxTnpBek5qSXlNM3g4TWpVNU9IeDhLRTBwSUVSeWRYQmhiQ0JiUm1sc1pTQlZjR3h2WVdSZA=mccullough, is likely a malicious download URL. The document body is heavily obfuscated and does not provide clear textual lures.

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emailgoal.com/wing/herding/bartending.beause?lizards=RmlmYSAyMgRml&&ZG93bmxvYWR8dlM5TlcxbWQzeDhNVFkxTnpBek5qSXlNM3g4TWpVNU9IeDhLRTBwSUVSeWRYQmhiQ0JiUm1sc1pTQlZjR3h2WVdSZA=mccullough
    • https://formyanmarbymyanmar.com/upload/files/2022/07/oLeW1U3iq8rWxyxt55Fb_05_570b9ddb576730d61327620bc7f0ea69_file.pdf
    • https://earthoceanandairtravel.com/2022/07/05/fifa-22-full-license-x64-updated-2022/
    • http://sourceofhealth.net/2022/07/05/fifa-22-universal-keygen-with-product-key-free-download-pc-windows-final-2022/
    • https://paddock.trke.rs/upload/files/2022/07/IAUbQlcBttkEJThrs9y1_05_db2394d906208a9dca5d6fa6b77d63c7_file.pdf
    • https://www.sdssocial.world/upload/files/2022/07/yY5p12JBRuv9V3aFcqGK_05_570b9ddb576730d61327620bc7f0ea69_file.pdf
    • https://mscenter.be/sites/default/files/webform/Fifa-22_3.pdf
    • http://buyzionpark.com/?p=32179
    • https://baptizein.com/upload/files/2022/07/Gau7Wt3mhWqgzlmoZJ5m_05_4fa12b8e554b25bdea10f5ff93641a2d_file.pdf
    • https://www.voyavel.it/fifa-22-hacked-keygen-full-version-free/
    • https://mycoopmed.net/fifa-22-activation-code-updated-2022/
    • https://www.keyringscustom.com.au/sites/www.keyringscustom.com.au/files/webform/Fifa-22_35.pdf
    • https://sipepatrust.org/fifa-22-nulled-patch-with-serial-key-latest-2022/
    • http://capabiliaexpertshub.com/fifa-22-install-crack-x64/
    • http://pussyhub.net/fifa-22-product-key-and-xforce-keygen-product-key-full-free-download/
    • https://xn--80aagyardii6h.xn--p1ai/wp-content/uploads/2022/07/heanees.pdf
    • https://lms.trungtamthanhmy.com/blog/index.php?entryid=3225
    • https://fumostoppista.com/fifa-22-product-key-and-xforce-keygen-license-code-keygen-april-2022/
    • https://homeimproveinc.com/fifa-22-patch-full-version-activation-free-download-pc-windows/
    • http://cicatsalud.com/html/sites/default/files/webform/Fifa-22_81.pdf
    • https://www.ocacp.com/wp-content/uploads/2022/07/dewfall.pdf
    • https://formyanmarbymyanmar.com/upload/files/2022/07/oLeW1U3iq8rWxyxt55Fb_05
    • http://sourceofhealth.net/2022/07/05/fifa-22-universal-keygen-with-product-key-free-
    • https://paddock.trke.rs/upload/files/2022/07/IAUbQlcBttkEJThrs9y1_05_db2394d90620
    • https://www.sdssocial.world/upload/files/2022/07/yY5p12JBRuv9V3aFcqGK_05_570b9d
    • https://baptizein.com/upload/files/2022/07/Gau7Wt3mhWqgzlmoZJ5m_05_4fa12b8e55
    • https://www.keyringscustom.com.au/sites/www.keyringscustom.com.au/files/webform/
    • http://pussyhub.net/fifa-22-product-key-and-xforce-keygen-product-key-full-free-
    • https://fumostoppista.com/fifa-22-product-key-and-xforce-keygen-license-code-keygen-
    • https://homeimproveinc.com/fifa-22-patch-full-version-activation-free-download-pc-
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.