Malicious PDF — malware analysis report

Static analysis result for SHA-256 d42012f1a7588ad0…

MALICIOUS

PDF

117.8 KB Created: 2022-07-04 01:56:41 +00:00 Authoring application: thanniag (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: c1ce502f01b4504cbc2be304b9ea5bc0 SHA-1: 6ec4870f02f1b60523f7672effccc8b2dba023ce SHA-256: d42012f1a7588ad01e314708a4b2570acce6c36823ecace88cdc1bc3c8ecc040
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to pages offering software cracks and activation keys. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely to distribute malware or lead users to malicious sites. The primary IOC is the embedded URL http://find24hs.com/, which is likely a download or redirection point for a second-stage payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0272

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://find24hs.com/ZG93bmxvYWR8V3A1TXpJMWVIeDhNVFkxTmpnNU1qTTFNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/abscess/adoptable.fernuniversit/endometriosis/galatea?V2luZG93cyAxMCBGaXJld2FsbCBDb250cm9sIE5ldHdvcmsgQ2xvdWQgRWRpdGlvbgV2l&nasdr=perf
    • https://www.indianhomecook.com/wp-content/uploads/2022/07/Wandering_Spider_Screensaver_Crack_Activation_Key_Free_Download_For_Windows.pdf
    • https://healthfitstore.com/2022/07/04/terra-incognita-2007-crack-free-download-latest/
    • http://brotherskeeperint.com/2022/07/logonchange-crack-activation-code-with-keygen-free-download/
    • https://studiolegalefiorucci.it/2022/07/04/ant-loupe-crack-free-registration-code-free/
    • https://gogathr.live/upload/files/2022/07/ZdXda9R6Vp71LIrGmStX_04_d5c634364e6d3497f669fdf3250642e0_file.pdf
    • https://longitude123.net/sitegrinder-3-0-3-crack-mac-win/
    • https://oleciya.com/trick-or-treat-halloween-wallpaper-pack-crack-free-download.html
    • https://storage.googleapis.com/paloodles/upload/files/2022/07/sqlvYI8cXYQrLtUSdlv4_04_958332f196a1b44d552db4bd304905d5_file.pdf
    • https://paydayplus.net/system/files/webform/yasella28.pdf
    • https://wetraveleasy.com/2022/07/04/pcapsimpleparser-crack-free-download-latest-2022/
    • https://noshamewithself.com/upload/files/2022/07/isWrWE3Y4IEG1an2La6D_04_958332f196a1b44d552db4bd304905d5_file.pdf
    • https://fraenkische-rezepte.com/mba-stopwatch-crack-full-product-key-free-download/
    • https://autko.nl/2022/07/velux-daylight-visualizer-crack-free-march-2022/
    • http://yogaapaia.it/archives/33244
    • https://grivaacapital.com/wp-content/uploads/2022/07/Mr_Alias_Pro-1.pdf
    • http://www.diarioelsoldecusco.com/advert/jarp-crack-winmac/
    • https://www.southwickma.org/sites/g/files/vyhlif1241/f/uploads/zoning_districts_1.pdf
    • https://trabal.mx/2022/07/pdf-logo-remover-crack-license-code/
    • https://avicii.app/upload/files/2022/07/mx85aUrSXpg51IbTsFYz_04_d5c634364e6d3497f669fdf3250642e0_file.pdf
    • https://www.indianhomecook.com/wp-content/uploads/2022/07/Wande
    • https://healthfitstore.com/2022/07/04/terra-incognita-2007-crack-free-
    • http://brotherskeeperint.com/2022/07/logonchange-crack-activation-
    • https://studiolegalefiorucci.it/2022/07/04/ant-loupe-crack-free-
    • https://gogathr.live/upload/files/2022/07/ZdXda9R6Vp71LIrGmStX_04_d
    • https://oleciya.com/trick-or-treat-halloween-wallpaper-pack-crack-free-
    • https://storage.googleapis.com/paloodles/upload/files/2022/07/sqlvYI8c
    • https://wetraveleasy.com/2022/07/04/pcapsimpleparser-crack-free-
    • https://noshamewithself.com/upload/files/2022/07/isWrWE3Y4IEG1an2L
    • https://fraenkische-rezepte.com/mba-stopwatch-crack-full-product-key-
    • https://autko.nl/2022/07/velux-daylight-visualizer-crack-free-
    • https://grivaacapital.com/wp-
    • https://www.southwickma.org/sites/g/files/vyhlif1241/f/uploads/zoning_
    • https://avicii.app/upload/files/2022/07/mx85aUrSXpg51IbTsFYz_04_d5c
    • https://wakelet.com/wake/XmZ-B3pR1RgFXOI7vCI7u
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/