PDF static analysis report

Static analysis result for SHA-256 9d99f1834061d625…

SUSPICIOUS

PDF

132.5 KB Created: 2022-07-04 00:40:22 +00:00 Authoring application: halnirv (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: d31c769d0c58d286af1962fac8fd9760 SHA-1: fe1a012ec57805c2a6ed11a5eda6bcddbfb33991 SHA-256: 9d99f1834061d62593a760f3ced1d32eefb8e82d95e63c560e6ab7cb9b2ce2da
54 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple heuristics indicating it advertises cracked software and includes external URIs. One URI points to an IP address, and another is a domain that appears to be a lure for downloading software. The document body is heavily obfuscated and does not provide clear textual content, but the presence of these links strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0090

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestsmartfind.com/ZG93bmxvYWR8dFkyTVRSaE1IeDhNVFkxTmpnNU1qTTFNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/asked/UHVyYW4gRGVmcmFnUHV=outclass=denote.thins PDF link annotation
    • https://www.8premier.com/free-combine-pdf-4dots-crack-download/In PDF document text
    • https://www.coeco.com/system/files/webform/resumes/percnei922.pdfIn PDF document text
    • https://copasulassessoria.com.br/advert/nfsbarcelona-crack/In PDF document text
    • https://www.golfmotion.com.au/sites/default/files/webform/Move-Mouse.pdfIn PDF document text
    • https://obscure-tor-21456.herokuapp.com/ellmari.pdfIn PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/georwen137.pdfIn PDF document text
    • http://dponewsbd.com/?p=15560In PDF document text
    • https://hudson-backbacon-21604.herokuapp.com/estfri.pdfIn PDF document text
    • https://fryter.com/upload/files/2022/07/3ec7sGuQ9cqapgWYAlVB_04_1f0914eba5980325efa7a466de41c353_file.pdfIn PDF document text
    • https://topnotchjobboard.com/system/files/webform/resume/rehkau565.pdfIn PDF document text
    • https://blaquecat.com/community/upload/files/2022/07/yNsAEZKfuNE2LXE2wKmx_04_5001fdfba6aa4cde8d9f1c7db39130d7_file.pdfIn PDF document text
    • https://www.careerfirst.lk/system/files/webform/cv/Visual-Autorun.pdfIn PDF document text
    • https://bali.live/wp-content/uploads/2022/07/rowyoty.pdfIn PDF document text
    • https://shielded-shelf-30046.herokuapp.com/Flickr_Schedulr.pdfIn PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/vibebir380.pdfIn PDF document text
    • http://3.234.42.222/blog/index.php?entryid=3675PDF link annotation
    • https://attitude.ferttil.com/upload/files/2022/07/mZiLIUcvwBpDf6eupoHZ_04_9fac7048a671042f4da4159d520fa04c_file.pdfIn PDF document text
    • https://myvideotoolbox.com/airparrot-crack-license-key-full-for-pc-2022/In PDF document text
    • https://www.reperiohumancapital.com/system/files/webform/Free-RS-Lead-Extractor-Portable.pdfIn PDF document text
    • https://ak-asyl-mgh.de/advert/portable-wintrezur-crack-free-pc-windows/In PDF document text
    • https://blaquecat.com/community/upload/files/2022/07/yNsAEZKfuNE2LXE2wKmx_04_5001fdfba6aa4cde8d9f1c7db3913In PDF document text
    • https://attitude.ferttil.com/upload/files/2022/07/mZiLIUcvwBpDf6eupoHZ_04_9fac7048a671042f4da4159d520fa04c_file.pIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_010_off0001a084.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A084 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7

Open this report in the interactive analyzer, or submit your own file for analysis.