Malicious PDF — malware analysis report

Static analysis result for SHA-256 d194f340e35fe872…

MALICIOUS

PDF

139.8 KB Created: 2022-06-12 16:31:17 +02:00 Authoring application: locsach (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 84d4d4335b44d8b9f7827c926acaf6b0 SHA-1: 98ceb2e8b1b7167abbd20ef83036b9749b2b4bb6 SHA-256: d194f340e35fe87286cd6d91fcd218f7d4283be39b04e8c51576ba101932143c
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains a significant number of external links, indicating a link farm or redirection strategy. One prominent URL, http://evacdir.com/banisters/hypothalamus?advocation=museumgoers.downing&RXB1YnNvZnQgS2luZGxlIERybSBSZW1vdmFsIEtleWdlbiBDcmFjawRXB=ZG93bmxvYWR8UGc3YUhSNGFYeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/robertson, appears to be a lure for downloading software. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external links, suggesting a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier clean score 0.0087

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/banisters/hypothalamus?advocation=museumgoers.downing&RXB1YnNvZnQgS2luZGxlIERybSBSZW1vdmFsIEtleWdlbiBDcmFjawRXB=ZG93bmxvYWR8UGc3YUhSNGFYeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/robertson
    • https://kivabe.info/wp-content/uploads/2022/06/Sap_Ecc_60_Software_Free_Download_Full_Versionl.pdf
    • https://cdn.scholarwithin.com/media/20220612073115/X_Plane_JARDesign_A320_V3_1r2_X_Plane_11_Only.pdf
    • https://aposhop-online.de/2022/06/12/adobe-photoshop-lightroom-cc-2020-8-5-1-crack-work/
    • https://misasgregorianas.com/titanic-1997-tamil-dubbed-movie-51-480p-extended-bluray-top/
    • https://eleven11cpa.com/wp-content/uploads/2022/06/Creo_Preps_515_incl_crack_programa_keygen.pdf
    • http://feelingshy.com/patched-ibm-lotus-smartsuite-millennium-9-8-1-9-8-6-all-languages-new/
    • https://eclecticapparels.com/wp-content/uploads/2022/06/Altair_Flow_Simulator_2019_Crack.pdf
    • https://thebeeinfo.com/wp-content/uploads/2022/06/chradri.pdf
    • https://xn--80aagyardii6h.xn--p1ai/free-download-textbook-of-pharmacognosy-by-c-k-kokate/
    • https://rajnikhazanchi.com/yamaha-tyros-4-vst/
    • https://demoforextrading.com/soal-soal-tes-paps-ugm/
    • https://staging.sonicscoop.com/advert/dll-suite-2013-0-0-2109-with-key-tordigger-full-version-install/
    • https://tuscomprascondescuento.com/?p=28885
    • https://ayusya.in/stylemagic-ya-12/
    • http://mentalismminds.com/wp-content/uploads/2022/06/probina_orion_v15_full.pdf
    • https://vineyardartisans.com/artisan-pages/?p=13863
    • https://afribizkid.africa/wp-content/uploads/2022/06/gerezyr.pdf
    • https://brightsun.co/wp-content/uploads/2022/06/warbanc.pdf
    • https://asqstay.com/wp-content/uploads/2022/06/wayawall.pdf
    • https://ajkersebok.com/meltdowndeepfreezedownloadwindows/
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000011d1.bin
a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11D1 120140 bytes
stream_010_off0001b2f5.bin
df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B2F5 119072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.