Malicious PDF — malware analysis report

Static analysis result for SHA-256 beb654e1b49da212…

MALICIOUS

PDF

79.6 KB Created: 2022-06-12 17:09:22 +02:00 Authoring application: herarag (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 4ede4a5da6abb5e4868c6737c3c9cb70 SHA-1: 0314622ae0b156dddd6b21aa6817178f81ed21ae SHA-256: beb654e1b49da212176349647f0d280f771cf838bd81da62e81a3a4c333e9bee
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are advertised as cracked software. One of the embedded URIs, http://evacdir.com/maluna/..., is likely a downloader for a second-stage payload. The document's primary purpose appears to be to trick users into visiting these malicious links.

Machine Learning

  • Nyx PDF Classifier clean score 0.2226

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/maluna/ZG93bmxvYWR8ZFk2YVc0M2MzeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/refracts/ermine.ooohh.T25lIFR3byBUaHJlZSBNb3ZpZSBIaW5kaSBEdWJiZWQgTXA0IEhkIERvd25sb2FkT25/plga/steenbok/ PDF link annotation
    • https://zariembroidery.com/wp-content/uploads/2022/06/terizab.pdfIn PDF document text
    • https://carolwestfineart.com/total-war-warhammer-2-crashing-after-battle/In PDF document text
    • https://mondetectiveimmobilier.com/wp-content/uploads/2022/06/goantry.pdfIn PDF document text
    • https://weltverbessern-lernen.de/wp-content/uploads/2022/06/ashfaq_hussain_electrical_machines_book_pdf_download.pdfIn PDF document text
    • https://wilsonvillecommunitysharing.org/wp-content/uploads/2022/06/CCleaner_5135460_Professional_Plus_Crack_And_Serial_Key_Download_FREE.pdfIn PDF document text
    • https://www.mangasman.com/wp-content/uploads/2022/06/softpay.pdfIn PDF document text
    • https://ksycomputer.com/refx-nexus-2-2-1-update-crack-finally-it-has-happened/In PDF document text
    • https://angry-mob.com/wp-content/uploads/2022/06/bupena_kelas_5_sd_pdf_140.pdfIn PDF document text
    • https://www.raven-guard.info/pcmscan-v2-4-12build-1194-keygen-rar/In PDF document text
    • https://freetalkusa.app/upload/files/2022/06/29REhmREDcSdYNwGS1Ae_12_395317e76c156fcbd63b04f30fa7584a_file.pdfIn PDF document text
    • https://kopuru.com/wp-content/uploads/2022/06/windows_8_64_bit_icin_solidcam_2013_indir.pdfIn PDF document text
    • https://paulinesafrica.org/?p=78313In PDF document text
    • http://wp2-wimeta.de/delphi-10-seattle-keygen-portable/In PDF document text
    • https://luxurygamingllc.com/traktor-3-le-bcd3000-serial-number-rar/In PDF document text
    • https://matesmeetup.com/upload/files/2022/06/Pi9njovx1Xp5GFrWFqPI_12_395317e76c156fcbd63b04f30fa7584a_file.pdfIn PDF document text
    • https://www.beaches-lakesides.com/wp-content/uploads/2022/06/Train_Simulator_RhB_Enhancement_Pack_03_AddOn_Free_Download_BETTER.pdfIn PDF document text
    • https://intrendnews.com/ontrack-disk-supervisor-9-57-boot-iso-zip-13-puntate-grammatica-t/In PDF document text
    • https://thevaluesquares.com/madame-d-syuga-pdf-31/In PDF document text
    • https://unimedbeauty.com/nautical-almanac-1990-pdf-download/In PDF document text
    • https://bookuniversity.de/wp-content/uploads/2022/06/tanahaz.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000eb1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEB1 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.