Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1beee2b495e13fc…

MALICIOUS

PDF

124.3 KB Created: 2022-06-09 01:36:57 +02:00 Authoring application: denwill (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 8652568d03199abf1accb8bcb244f040 SHA-1: 255ecf377fc5a9a225e782634f33dc600c8ff0b7 SHA-256: c1beee2b495e13fce62b5512db7ed7b7ad78f7869faba909f7646518a50475e5
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are advertised as cracked software downloads. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, and 'PDF_CRACKED_SOFTWARE_LURE' specifically identifies the nature of these links. The primary IOC is the first external URI found, which likely serves as a download or redirection point for malicious content.

Machine Learning

  • Nyx PDF Classifier clean score 0.0206

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/eggy/inimical/paisley?transgression=RnJlZSBWYXN0dSBTaGFzdHJhIEVib29rIERvd25sb2FkcyBWYWFzdHUgQm9va3MgVGVsdWd1IDUzRnJ&kearney=/jonathon.ZG93bmxvYWR8NE5TTlRjd2ZId3hOalUwTnpNd09EZzJmSHd5TlRjMGZId29UU2tnY21WaFpDMWliRzluSUZ0R1lYTjBJRWRGVGww=troller PDF link annotation
    • https://www.movimento2stellette.it/wp-content/uploads/2022/06/fabkaf.pdfIn PDF document text
    • http://torbayexperts.com/wp-content/uploads/2022/06/download_Ankhon_Dekhi_movie_torrent_1080p.pdfIn PDF document text
    • https://www.coursesuggest.com/wp-content/uploads/2022/06/Sandilyan_Jala_Deepam_Part_1pdf.pdfIn PDF document text
    • https://vogelvriendendoesburg.nl/index.php/advert/full-cakewalk-boost-11-vst-plug-in/In PDF document text
    • http://www.tutoradvisor.ca/mastram-tamil-dubbed-movie-download/In PDF document text
    • https://www.promorapid.com/upload/files/2022/06/ohevD7ZhZzTQOyvMd4uI_09_0fe4663b09d952f56714dec300fe0ec7_file.pdfIn PDF document text
    • https://travelwithme.social/upload/files/2022/06/CQM679Z8xfXS3sK8kpMm_08_fc502bdaf4afd2b0b39842e44be22b72_file.pdfIn PDF document text
    • http://theartdistrictdirectory.org/wp-content/uploads/2022/06/palitan_indie_film_full_movie_download.pdfIn PDF document text
    • https://colonialrpc.com/advert/adobe-cs3-keygen-free-download-of-x-1566-exclusive/In PDF document text
    • https://www.cheddrbox.com/upload/files/2022/06/l7zkj5oQA88snPLylvrl_08_fc502bdaf4afd2b0b39842e44be22b72_file.pdfIn PDF document text
    • http://it-labx.ru/?p=28146In PDF document text
    • https://tecunosc.ro/upload/files/2022/06/TkajSx3fGBz4bhU7q8Wd_08_0fe4663b09d952f56714dec300fe0ec7_file.pdfIn PDF document text
    • http://feelingshy.com/wp-content/uploads/2022/06/prymale.pdfIn PDF document text
    • https://www.papershoot.com/wp-content/uploads/Worms_Clan_Wars_Multiplayer_Crack_19.pdfIn PDF document text
    • https://www.sumisurabespoke.it/wp-content/uploads/2022/06/Tenmt22net_Video_Bapakbapak_Polisi_Gay_Indonesi_Posso_Barbie_Depeche.pdfIn PDF document text
    • https://www.academiahowards.com/wp-content/uploads/2022/06/dellaw.pdfIn PDF document text
    • https://chichiama.net/?p=38596In PDF document text
    • https://fuerzasparavivir.com/wp-content/uploads/2022/06/aggrella.pdfIn PDF document text
    • https://www.clyouththeatre.org/crack-sonic-academy-kick-nicky-romero-edition-v1-01-win-macosx-incl-k.htmlIn PDF document text
    • http://torbayexperts.com/wp-content/uploads/2022/06/download_ankhon_dekhi_movie_torrent_1080p.pdfIn PDF document text
    • https://wakelet.com/wake/h112PuxuciUWigWjv8UUKIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000f66.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF66 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.