Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba92723ddbeb985e…

MALICIOUS

PDF

163.7 KB Created: 2022-07-05 18:32:48 +00:00 Authoring application: margeor (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 3228755028013637ef19a14bbe50f7a0 SHA-1: c9c8e6261237d4e7e764366c27facaa9b5d41794 SHA-256: ba92723ddbeb985ecda07ec5e0b51f8a94f44a0ffad3526e903efa9fce592ed6
74 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple heuristics indicating a lure for cracked software and password-protected archives. It embeds external URLs that lead to sites advertising pirated software, suggesting the primary goal is to trick users into downloading potentially malicious files disguised as software cracks. The presence of a 'password-protected archive handoff' heuristic further supports this, as it's a common tactic to bypass security scans.

Machine Learning

  • Nyx PDF Classifier clean score 0.0045

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thedirsite.com/RmlmYSAyMgRml/coupons/intimacy.pestle?jelinek=ZG93bmxvYWR8UloyTkhKaFpIeDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=lumberyard PDF link annotation
    • https://hissme.com/upload/files/2022/07/N7J9ThmsLNiFkfJnjWXo_05_24d6b518ded755559964e5bbbdf0f265_file.pdfIn PDF document text
    • https://j-core.club/2022/07/05/fifa-22-crack-keygen-product-key-free-download-x64/In PDF document text
    • https://4j90.com/fifa-22-crack-patch-2/In PDF document text
    • https://himarkacademy.tech/blog/index.php?entryid=7362In PDF document text
    • http://karnalketo.com/wp-content/uploads/2022/07/Fifa_22_Mem_Patch___MacWin_Final_2022.pdfIn PDF document text
    • https://ameeni.com/upload/files/2022/07/QGvrM74JvncUxsZooD35_05_57c2dee70e466ea5ed29c23f77f79b6c_file.pdfIn PDF document text
    • https://www.ipaustralia.gov.au/system/files/webform/policy_register_uploads/fifa-22_23.pdfIn PDF document text
    • http://imagesmagazinelr.com/?p=3245In PDF document text
    • https://aisikho.guru/blog/index.php?entryid=3168In PDF document text
    • https://ccptwo.com/?p=22560In PDF document text
    • https://www.hajjproperties.com/advert/fifa-22-crack-activation-code-with-license-code-download-3264bit/In PDF document text
    • https://www.ci.neptune-beach.fl.us/sites/g/files/vyhlif3516/f/uploads/2022_city_council_meeting_calendar.pdfIn PDF document text
    • http://brotherskeeperint.com/2022/07/fifa-22-jb-keygen-exe-free-2/In PDF document text
    • https://www.alnut.com/fifa-22-hack-patch-activation-code/In PDF document text
    • https://popstay.info/upload/files/2022/07/U7t7kueljBVc6tuvw2EV_05_24d6b518ded755559964e5bbbdf0f265_file.pdfIn PDF document text
    • http://streamcolors.com/?p=19578In PDF document text
    • https://ozrural.com/index.php/advert/fifa-22-keygen/In PDF document text
    • https://wilsonvillecommunitysharing.org/fifa-22-keygen-exe/In PDF document text
    • http://www.healthplexperformance.com/system/files/webform/fifa-22.pdfIn PDF document text
    • https://csermooc78next.blog/2022/07/06/fifa-22-universal-keygen-2/In PDF document text
    • https://hissme.com/upload/files/2022/07/N7J9ThmsLNiFkfJnjWXo_05_In PDF document text
    • https://j-core.club/2022/07/05/fifa-22-crack-keygen-product-key-free-In PDF document text
    • http://karnalketo.com/wp-content/uploads/2022/07/Fifa_22_Mem_PatIn PDF document text
    • https://ameeni.com/upload/files/2022/07/QGvrM74JvncUxsZooD35_0In PDF document text
    • https://www.ipaustralia.gov.au/system/files/webform/policy_register_In PDF document text
    • https://www.hajjproperties.com/advert/fifa-22-crack-activation-code-In PDF document text
    • https://www.ci.neptune-beach.fl.us/sites/g/files/vyhlif3516/f/uploads/In PDF document text
    • https://popstay.info/upload/files/2022/07/U7t7kueljBVc6tuvw2EV_05In PDF document text
    • http://www.healthplexperformance.com/system/files/webform/fifa-2In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.