PDF static analysis report

Static analysis result for SHA-256 bde798457fa628c2…

SUSPICIOUS

PDF

113.1 KB Created: 2022-07-08 02:52:20 +00:00 Authoring application: chremel (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: b4640a167dc0fa2f1c37f56e92effca0 SHA-1: 78be7b817976f23158915e560fbb94bfca729f9b SHA-256: bde798457fa628c2ab955d007a14ada82dca52aae83c7048cc5d9d76702ae436
34 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, with one heuristic specifically identifying a 'cracked software lure'. The presence of these links, particularly the one pointing to 'raisengine.com', suggests an attempt to trick users into downloading potentially malicious files disguised as cracked software. No scripts were extracted, but the overall pattern indicates a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0187

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://raisengine.com/biologics.dispensation?Um9jc2NpZW5jZSBSb2NwbGFuZSBWMiAwMjkucmFyUm9=freezers&ZG93bmxvYWR8eDdIWkdOMVpIeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA=portimao& PDF link annotation
    • http://www.divinejoyyoga.com/wp-content/uploads/2022/07/la_edad_de_oro_del_pop_espaol_torrent.pdfIn PDF document text
    • https://www.straightnorth.com/system/files/webform/internet-marketing-account-manager/Adobe-Acrobat-Pro-DC-2018-March-Updated-Patch.pdfIn PDF document text
    • https://www.artec3d.com/de/system/files/webform/business_development/aldhara934.pdfIn PDF document text
    • https://www.raven-guard.info/buku-sbk-kelas-5-sd-bse-3/In PDF document text
    • https://blnovels.net/crack-msact-plus-1-0-8-b2-by-ratiborusbabupc-new/In PDF document text
    • https://burmarauto.com/digital-anarchy-toonit-photo/In PDF document text
    • https://gembeltraveller.com/keygen-bestxf3dsmax2012x64exe/In PDF document text
    • https://massagemparacasais.com/?p=8197In PDF document text
    • https://agendaprime.com/wp-content/uploads/2022/07/garjoel.pdfIn PDF document text
    • https://black-affluence.com/social/upload/files/2022/07/SmXEn9tKZ4WRV46wgdf6_08_629c322e69ab679f26c8408cd84c8a27_file.pdfIn PDF document text
    • https://hoboshuukan.com/full-wonderfox-hd-video-converter-factory-pro-13-4-keygen-top/In PDF document text
    • http://www.hva-concept.com/turbocad-pro-platinum-20-keygen-bestl/In PDF document text
    • https://asaltlamp.com/wp-content/uploads/2022/07/Windows_7_81_10_X86_X64_DUALBOOT_ESD_6in1_ENU_AUG_2018_Gen2_-1.pdfIn PDF document text
    • http://www.interprys.it/wp-content/uploads/2022/07/Topaz_Sharpen_AI_145_Crack_Full_Review_UPD.pdfIn PDF document text
    • http://clubonlineusacasino.com/the-duxbury-braille-translator-10-4-authorization-file-download-free/In PDF document text
    • https://oursocial.io/upload/files/2022/07/vvZMNWq3bDgC8ZVzRGzg_08_ab7355016ecd9d10d57ecf0531372b53_file.pdfIn PDF document text
    • https://sussexteachers.co.uk/sites/default/files/webform/FaceGen-Modeller-341-Portable.pdfIn PDF document text
    • https://recreovirales.com/easy-speech2text-is-perfect-for-converting-speech-to-text-with-ease/In PDF document text
    • http://topfleamarket.com/?p=32555In PDF document text
    • http://prophperszon.yolasite.com/resources/Grandtheftautovpatchfixv102310corex-UPDATED.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.