Malicious PDF — malware analysis report

Static analysis result for SHA-256 bade6b2dde1c5f5d…

MALICIOUS

PDF

123.3 KB Created: 2022-07-06 01:50:01 +00:00 Authoring application: yesdebr (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 2d996a6e20e6e0506345eee4342335d0 SHA-1: 16cb77784223ca8ab19a3cb1c43e5761368afd79 SHA-256: bade6b2dde1c5f5dc576169cf5e940739c02571a4b033a407f0203a8d07baf95
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm designed to attract traffic or distribute further malicious content. One notable URL, http://siteslocate.com/persie/VGVvcmV4IElucGFpbnQgOC4xIGtleWdlbgVGV/cinder.dict.feedstuffs/klinger?ZG93bmxvYWR8eWwzTW1OMVpYeDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=pastried, is flagged as an external URI and is likely part of the distribution mechanism. The presence of numerous links, including one to a potentially malicious domain, indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0124

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://siteslocate.com/persie/VGVvcmV4IElucGFpbnQgOC4xIGtleWdlbgVGV/cinder.dict.feedstuffs/klinger?ZG93bmxvYWR8eWwzTW1OMVpYeDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=pastried
    • https://studiblog.net/wp-content/uploads/2022/07/Apple_Motion_545_Cracked_for_macOS.pdf
    • https://otelgazetesi.com/advert/download-i-am-alive-on-pc-top/
    • https://sleepy-garden-60662.herokuapp.com/syltia.pdf
    • https://xtc-hair.com/mkey-v812build-11-version-free-__full__-download/
    • http://wavecrea.com/?p=11575
    • https://www.iltossicoindipendente.it/wp-content/uploads/2022/07/Tumhari_Sulu_Movie_Download_In_Hindi_Dubbed_Mp4_dream_mindma.pdf
    • http://brotherskeeperint.com/2022/07/crack-_best_-registration-code-excel-password-recovery-lastic/
    • https://janshaktinews.in/wp-content/uploads/2022/07/garnahe.pdf
    • https://movingbay.com/wp-content/uploads/2022/07/Mercedes_Benz_Navigation_DVD_COMAND_APS_Europe_NTG2_5_Disk_1.pdf
    • https://likesmeet.com/upload/files/2022/07/jXzNxJlCzvIPJX5juZtK_06_c258dcda1f3ab349fc8760963cce4f7e_file.pdf
    • https://maniatech-academy.co.uk/blog/index.php?entryid=5
    • https://pacific-plateau-25233.herokuapp.com/affcas.pdf
    • https://morning-bastion-40034.herokuapp.com/x_force_keygen_revit_2014_download.pdf
    • https://balancingthecrazy.com/2022/07/05/atv-dvwk-a-131-e-pdfl/
    • https://www.vakantiehuiswinkel.nl/fl-11-crack-portable-dll-files/
    • https://www.greatescapesdirect.com/2022/07/advancedstrengthandappliedelasticity4theditionbookspdffile-top/
    • https://mamawong.de/usbcrypt-10-9-keygen-software-extra-quality/
    • https://studiblog.net/wp-content/uploads/2022/07/Apple_Motion_54
    • https://xtc-hair.com/mkey-v812build-11-version-
    • https://www.iltossicoindipendente.it/wp-content/uploads/2022/07/T
    • http://brotherskeeperint.com/2022/07/crack-_best_-registration-
    • https://movingbay.com/wp-content/uploads/2022/07/Mercedes_Ben
    • https://likesmeet.com/upload/files/2022/07/jXzNxJlCzvIPJX5juZtK_06
    • https://morning-bastion-40034.herokuapp.com/x_force_keygen_revi
    • https://www.greatescapesdirect.com/2022/07/advancedstrengthand
    • https://secureservercdn.net/198.71.233.69/5z3.800.myftpupload.com/wp-content/uploads/2022/07/igo_my_way_android_240x320_apk_download_torrent.pdf?time=1657071525
    • https://www.colorado.edu/biochemistry/system/files/webform/patfred193.pdf
    • https://gestempsasiny.wixsite.com/amrobalcoo/post/stellar-phoenix-jpeg-repair-5-0-0-0-link-crack-utorrent
    • http://www.tcpdf.org
    • https://secureservercdn.net/198.71.233.69/5z3.800.myftpupload.co
    • https://www.colorado.edu/biochemistry/system/files/webform/patfre
    • https://gestempsasiny.wixsite.com/amrobalcoo/post/stellar-phoenix-
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.