Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9dbf4ba801c9e7e…

MALICIOUS

PDF

116.9 KB Created: 2022-07-03 18:51:53 +00:00 Authoring application: vyrnneli (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 87e9a2d75e41d5421bb2538e87f875a0 SHA-1: 194f821783c59ec5fdc55bf93da70baa1a21e13d SHA-256: a9dbf4ba801c9e7ed22a719183f6bb3549d62568249851cf958061d120c8f2c3
132 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link T1071.001 Web Protocols

The PDF contains a link to a suspicious URL that appears to be a download lure. The document also includes instructions for a password-protected archive, a common tactic to bypass gateway security. The presence of a LOLBin token sequence suggests an attempt to execute commands, likely to download and run a second-stage payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0229

Heuristics 6

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://findthisall.com/backboards/SmsyIEFpbWJvdCBEb3dubG9hZASms/crashers.spits?botanically=intimidation&ZG93bmxvYWR8d2gyTVRGNlptTjhmREUyTlRZM056RTRNVGg4ZkRJMU56UjhmQ2hOS1NCeVpXRmtMV0pzYjJjZ1cwWmhjM1FnUjBWT1hR=
    • http://latinon.com/?p=4228
    • https://www.vacanzenelcilento.info/wp-content/uploads/2022/07/Art_Plus_Digital_Photo_Recovery_61_0114_Serial_Crack_UPD.pdf
    • https://snackchallenge.nl/2022/07/03/rayman-raving-rabbids-2-pcmulti5-repack-new/
    • https://www.sartorishotel.it/movavi-video-editor-plus-14-2-0-hot-crack-with-activation-key-2018/
    • https://shalamonduke.com/the-age-of-blood-720p-torrent/
    • https://worldtradeoptions.com/wp-content/uploads/2022/07/Hitman_Absolution_Steam_Crack_TOP_Indir.pdf
    • http://touchdownhotels.com/embedded-real-time-operating-systems-by-rajkamal-pdf-free-150-verified/
    • https://www.egenergycorp.ph/sites/default/files/webform/keygen-xforce-inventor-2014.pdf
    • http://geniyarts.de/?p=26454
    • http://ticketguatemala.com/download-xforce-work-keygen-collaboration-for-revit-2016-activation/
    • https://captainseduction.fr/wp-content/uploads/2022/07/Jamella_D2_Hero_Editor_V1_13_Download_VERIFIED.pdf
    • https://www.dpfremovalnottingham.com/wp-content/uploads/2022/07/Lallamadadecthulhuedicionprimigeniapdf36_CRACKED.pdf
    • https://www.reperiohumancapital.com/system/files/webform/marchei568.pdf
    • https://believewedding.com/2022/07/03/gta-iv-v1-0-7-0-crack-joy-emu-hun-magyar-lng-download-link/
    • https://guaraparadise.com/2022/07/03/asusinstallationwizardwindows10high-quality-download/
    • https://fennylaw.com/magento-marketplace-multi-vendor-module-nulled-exclusive/
    • https://zeecanine.com/caramembukapasswordrardengancmd-hot/
    • https://beautyprosnearme.com/wp-content/uploads/2022/07/quarege.pdf
    • https://www.apokoronews.gr/advert/jenny-9-yo-fixed-full-version-flv/
    • https://beautypro
    • https://arctic.ucalgary.ca/system/files/webform/charbran987.pdf
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.