Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb31b9f87591d026…

MALICIOUS

PDF

127.2 KB Created: 2022-07-04 07:03:17 +00:00 Authoring application: ralywail (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: b25b0a1e1c5a68d2f5b7e4cf51025e50 SHA-1: 28cdb3453d51e8067644f704e54e9066124040f2 SHA-256: cb31b9f87591d026c23f646ad20e5a6a315abe17d7429bed33c0f25bf2a2caac
84 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.001 Malicious Link: User Execution

The PDF document employs social engineering tactics, specifically a browser extension installation lure, to deceive users. It also contains an external URI pointing to 'esecuritys.com', likely serving as a download or redirection point for the malicious payload. The document's structure and heuristics suggest it's designed to facilitate the installation of unwanted software or malware.

Machine Learning

  • Nyx PDF Classifier clean score 0.0082

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://esecuritys.com/internship/?amped=VW5TZWN1cmUVW5&barker=&ZG93bmxvYWR8aEMyWVdab01YeDhNVFkxTmpnNU1qTTFNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk=bergdorf&kroyer=
    • http://shalamonduke.com/?p=41829
    • https://opagac-elearning.org/blog/index.php?entryid=4035
    • http://www.vidriositalia.cl/?p=35345
    • http://mirrordancehair.com/?p=1993
    • https://www.linkspreed.com/upload/files/2022/07/Z4CKgYLdPi4zpm5FgXbe_04_11cf9f492e87da63fa1fbdfe8894456d_file.pdf
    • https://travelwithme.social/upload/files/2022/07/uPFXyAVjw67ZtbutNhSB_04_4f050f7013e1d776b673349d201f329e_file.pdf
    • http://shalamonduke.com/?p=41827
    • https://doitory.com/regalyzer-crack-with-key-free-download/
    • http://match2flame.com/qubus-1-0-3-crack-3264bit/
    • https://www.dkglobalrecruitment.com/sites/default/files/webform/IE-Password-Remover.pdf
    • https://tresorsiran.org/adobe-contribute-cs5-crack-with-serial-key-free/
    • https://aghadeergroup.com/2022/07/04/cd-rom-door-keeper-mac-win/
    • https://www.sl.nsw.gov.au/sites/default/files/webform/edsegabr25.pdf
    • https://ubipharma.pt/2022/07/04/generate-tones-by-frequency-software-crack/
    • https://xn--80aagyardii6h.xn--p1ai/wp-content/uploads/2022/07/aqua_3d_screensaver.pdf
    • http://myquicksnapshot.com/?p=19330
    • http://withszytax.yolasite.com/resources/Spanish-Verbs-15-Crack-Free-Latest-2022.pdf
    • https://searcheuropeanjobs.com/wp-content/uploads/2022/07/Free_Word_Doc_Excel_Xls_to_Htm_Html_Converter.pdf
    • https://wakelet.com/wake/aWBgz9_qFfFRhrvc3Pl_o
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.