Malicious PDF — malware analysis report

Static analysis result for SHA-256 d194f340e35fe872…

MALICIOUS

PDF

139.8 KB Created: 2022-06-12 16:31:17 +02:00 Authoring application: locsach (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 84d4d4335b44d8b9f7827c926acaf6b0 SHA-1: 98ceb2e8b1b7167abbd20ef83036b9749b2b4bb6 SHA-256: d194f340e35fe87286cd6d91fcd218f7d4283be39b04e8c51576ba101932143c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a significant number of external links, many of which advertise cracked software, indicating a lure for users seeking pirated software. One of the embedded URIs, http://evacdir.com/banisters/hypothalamus?advocation=museumgoers.downing&RXB1YnNvZnQgS2luZGxlIERybSBSZW1vdmFsIEtleWdlbiBDcmFjawRXB=ZG93bmxvYWR8UGc3YUhSNGFYeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/robertson, is likely part of a malicious campaign. The PDF structure and link farm suggest an attempt to drive traffic or distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier clean score 0.0087

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/banisters/hypothalamus?advocation=museumgoers.downing&RXB1YnNvZnQgS2luZGxlIERybSBSZW1vdmFsIEtleWdlbiBDcmFjawRXB=ZG93bmxvYWR8UGc3YUhSNGFYeDhNVFkxTkRrNE9URTJNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/robertson PDF link annotation
    • https://kivabe.info/wp-content/uploads/2022/06/Sap_Ecc_60_Software_Free_Download_Full_Versionl.pdfIn PDF document text
    • https://cdn.scholarwithin.com/media/20220612073115/X_Plane_JARDesign_A320_V3_1r2_X_Plane_11_Only.pdfIn PDF document text
    • https://aposhop-online.de/2022/06/12/adobe-photoshop-lightroom-cc-2020-8-5-1-crack-work/In PDF document text
    • https://misasgregorianas.com/titanic-1997-tamil-dubbed-movie-51-480p-extended-bluray-top/In PDF document text
    • https://eleven11cpa.com/wp-content/uploads/2022/06/Creo_Preps_515_incl_crack_programa_keygen.pdfIn PDF document text
    • http://feelingshy.com/patched-ibm-lotus-smartsuite-millennium-9-8-1-9-8-6-all-languages-new/In PDF document text
    • https://eclecticapparels.com/wp-content/uploads/2022/06/Altair_Flow_Simulator_2019_Crack.pdfIn PDF document text
    • https://thebeeinfo.com/wp-content/uploads/2022/06/chradri.pdfIn PDF document text
    • https://xn--80aagyardii6h.xn--p1ai/free-download-textbook-of-pharmacognosy-by-c-k-kokate/In PDF document text
    • https://rajnikhazanchi.com/yamaha-tyros-4-vst/In PDF document text
    • https://demoforextrading.com/soal-soal-tes-paps-ugm/In PDF document text
    • https://staging.sonicscoop.com/advert/dll-suite-2013-0-0-2109-with-key-tordigger-full-version-install/In PDF document text
    • https://tuscomprascondescuento.com/?p=28885In PDF document text
    • https://ayusya.in/stylemagic-ya-12/In PDF document text
    • http://mentalismminds.com/wp-content/uploads/2022/06/probina_orion_v15_full.pdfIn PDF document text
    • https://vineyardartisans.com/artisan-pages/?p=13863In PDF document text
    • https://afribizkid.africa/wp-content/uploads/2022/06/gerezyr.pdfIn PDF document text
    • https://brightsun.co/wp-content/uploads/2022/06/warbanc.pdfIn PDF document text
    • https://asqstay.com/wp-content/uploads/2022/06/wayawall.pdfIn PDF document text
    • https://ajkersebok.com/meltdowndeepfreezedownloadwindows/In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000011d1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11D1 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
stream_010_off0001b2f5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B2F5 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7

Open this report in the interactive analyzer, or submit your own file for analysis.