PDF malware analysis — malicious · ab07600a1d65f476

MALICIOUS

PDF

129.6 KB Created: 2022-07-08 05:00:44 +00:00 Authoring application: armajan (via PDF Master 1.0.1) First seen: 2022-07-15

MD5: 57e696cf6229ae4d077d7d2af1a11310 SHA-1: 4324ddc7d783b101698bd06e960740eae7a29f7e SHA-256: ab07600a1d65f476fe1709b5c977211fe0e5c899803e3df6c2f286c4461be9bd

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection mechanism. The primary URL, http://siteslocate.com/..., is suspicious and likely leads to a malicious download. The document body is heavily obfuscated and does not provide clear textual clues, but the presence of numerous external links points towards a delivery or phishing attack.

Machine Learning

Nyx PDF Classifier clean score 0.0096

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://siteslocate.com/ZG93bmxvYWR8WTFEWjJSbmMzeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/heartburning/bureaus.dirtying?standring/RGV2aW4gVG93bnNlbmQgLSBEaXNjb2dyYXBoeSAoRGlzY29ncmFmaWEpIFsxOTk2LTIwMTFdIFszMjBdIDE0RGV
- https://myirishconnections.com/wp-content/uploads/2022/07/CRACK_LinPlug_Octopus_v133_WiN_MacOSX_Incl_KeygenR2R_deepsta.pdf
- http://maili.demoe.cn:112/upload/files/2022/07/ENgeTz97Qu7UODtuIUKD_08_b40182de6986497ab0d25394c25699e4_file.pdf
- https://liquidonetransfer.com.mx/?p=43258
- https://globaltechla.com/net-protector-antivirus-crack-link-with-serial-key2019/
- https://kovaci-company.com/2022/07/08/ces-4-1-set-6000-colreg-marlins-english-test/
- http://www.cocinarconmilagros.com/wp-content/uploads/2022/07/eclipse_flyff_bot_download.pdf
- https://instantitschool.com/zaccaria-pinball-gold-pack-crack-download-free-pc-portable/
- https://trevelia.com/upload/files/2022/07/RXusTEVqSrVIteggH7Ap_08_b40182de6986497ab0d25394c25699e4_file.pdf
- https://justproms.com/upload/files/2022/07/uZumxeVUpYJftGuReFOT_08_39429bca5b1b0b83ea0271ad3e8cde3e_file.pdf
- https://www.cameraitacina.com/en/system/files/webform/feedback/patch-1222-football-manager-2012-crack.pdf
- https://meinbruck.de/wp-content/uploads/2022/07/World_War_Z_Full_Movie_In_Hindi_Dubbed_26.pdf
- https://nanacomputer.com/wondershare-filmora-9-crack-license-key-free-download-exclusive-2019/
- https://www.cameraitacina.com/en/system/files/webform/feedback/yessadmi29.pdf
- https://horley.life/tiny-talk-2a-teachers-book-pdf-link/
- https://www.saltroomhimalaya.com/ei-jig-standard-1530-pdf-download-updated/
- http://www.skyhave.com/upload/files/2022/07/XICrBSwTXOFr3YIyfkQD_08_39429bca5b1b0b83ea0271ad3e8cde3e_file.pdf
- https://diariosinfiltro.com/advert/guitar-hero-song-list-editor-download-updated/
- https://trello.com/c/hvcaHExd/100-autocadlt2015scaricarecrack64bitsit-work
- https://mahalaogborn562bpj.wixsite.com/gielebcasea/post/microsoft-expression-web-studio-4-ultimate-full-crack-updated-exe
- http://www.tcpdf.org
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.