PDF malware analysis — malicious · c80f6fc8ad38fb45

MALICIOUS

PDF

143.1 KB Created: 2022-07-05 19:47:26 +00:00 Authoring application: advband (via PDF Master 1.0.1) First seen: 2022-07-15

MD5: ff4d0d0cae7f899cc7913a864bc792e0 SHA-1: acc32e5469a5a73133f093548702eff727650a38 SHA-256: c80f6fc8ad38fb4530997d63adeaa7d8884532a4046165e3f49afed575ed56b0

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are SEO-optimized and point to other PDF files. One of the primary external URIs, http://xtraserp.com/certifying/cilicias/ZG93bmxvYWR8RE4zTnpCbGIzeDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/disqualify/?ostracizing=RmlmYSAyMgRml&eres=breakfasts, is likely a malicious download or phishing lure. The PDF structure and link farm indicate a campaign to drive traffic to potentially harmful sites.

Machine Learning

Nyx PDF Classifier clean score 0.0058

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://xtraserp.com/certifying/cilicias/ZG93bmxvYWR8RE4zTnpCbGIzeDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/disqualify/?ostracizing=RmlmYSAyMgRml&eres=breakfasts
- https://www.cameraitacina.com/en/system/files/webform/feedback/fifa-22_1872.pdf
- https://elolist.com/wp-content/uploads/2022/07/cailverb.pdf
- https://efekt-metal.pl/witaj-swiecie/
- https://www.town.lynnfield.ma.us/sites/g/files/vyhlif3391/f/uploads/field_use_regulations.pdf
- https://ig-link.com/fifa-22-serial-number-free-registration-code-free-download/
- https://massagemparacasais.com/?p=7509
- https://kwan-amulet.com/archives/1901338
- https://optimizetf.com/wp-content/uploads/2022/07/warrfre.pdf
- https://www.greatescapesdirect.com/2022/07/fifa-22-keygen-only/
- https://inobee.com/upload/files/2022/07/3reg9CI6O4F2yasHwLtV_05_59131aa8413dc1523218d43e50c7d132_file.pdf
- https://www.merrimacknh.gov/sites/g/files/vyhlif3456/f/uploads/2022_town_holidays.pdf
- https://savosh.com/fifa-22-serial-number-x64-2022/
- https://topnotchjobboard.com/system/files/webform/resume/fifa-22_363.pdf
- http://dealstoheal.com/wp-content/uploads/2022/07/Fifa_22-1.pdf
- https://tazneevee.com/wp-content/uploads/2022/07/Fifa_22-5.pdf
- https://awinkiweb.com/fifa-22-serial-number-full-torrent-free-mac-win/
- http://sundigitalstore.com/?p=57538
- https://richonline.club/upload/files/2022/07/p7fUTlMjFKXmpF3rS6ce_05_ee24108160377e202a208c02decad6a0_file.pdf
- https://richard-wagner-werkstatt.com/2022/07/05/fifa-22-hack-license-key-free-win-mac/
- https://inobee.com/upload/files/2022/07/3reg9CI6O4F2yasHwLtV_05_59131aa8413dc1523218d43e5
- https://richonline.club/upload/files/2022/07/p7fUTlMjFKXmpF3rS6ce_05_ee24108160377e202a208c0
- https://pindata.ams3.digitaloceanspaces.com/upload/files/2022/07/nd5Z79WWY49JJBEQxJyq_05_59131aa8413dc1523218d43e50c7d132_file.pdf
- http://www.tcpdf.org
- https://pindata.ams3.digitaloceanspaces.com/upload/files/2022/07/nd5Z79WWY49JJBEQxJyq_05_591
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/mm/
- http://www.aiim.org/pdfa/ns/extension/
- http://www.aiim.org/pdfa/ns/schema#
- http://www.aiim.org/pdfa/ns/property#
- http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.