Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc0c7be9c84b9d8a…

MALICIOUS

PDF

116.4 KB Created: 2022-07-02 21:15:48 +00:00 Authoring application: jaycser (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 770c3efd504fc4ff8e75dd4b71eabcb0 SHA-1: 9395818c196b7101aa880cefcb7caa0b5acc919c SHA-256: dc0c7be9c84b9d8ad6e4bab82a6a84a0fac839cd9284ed52b768dda60929da30
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of SEO-optimized links, many of which point to pages offering cracked software. This indicates a likely attempt to lure users into downloading malware disguised as legitimate software. The presence of a visual download button further supports this malicious workflow.

Machine Learning

  • Nyx PDF Classifier clean score 0.0119

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mydrugdir.com/adsw/RGVsY2FtIEFydENBTSBQcm8gVjIwMDggU1A1IEZ1bGwgUmV0YWlsIFdpdGggQ3JhY2sRGV=ZG93bmxvYWR8Z1o2WVdSamQzeDhNVFkxTmpjM01UZ3hPSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA.boltings&ungar=algorithms&diametrically=inherits
    • http://twinmyclub.com/wp-content/uploads/2022/07/FlippingBook_Publisher_V_2416_WORK_Crack_Serial_Keygen_Cd_Key.pdf
    • https://www.thepostermafia.com/2022/07/02/air-regulations-rk-bali-pdf-new/
    • https://www.articlemarketingitaliano.it/wp-content/uploads/2022/07/Vray_For_3ds_Max_2013_64_Bit_With_Crack_Free_Download.pdf
    • https://fam-dog.ch/advert/oxford-soluciones-bachiller-workbook-zip/
    • https://venbud.com/advert/tasher-desh-by-rabindranath-tagore-pdf-hot/
    • https://www.29chat.com/upload/files/2022/07/ZF2IrfUX96tLyCkWT1Jb_02_53788336172830123ed3306cb5ccaa5a_file.pdf
    • http://thebluedispatch.com/wp-content/uploads/2022/07/wintale.pdf
    • https://shalamonduke.com/martin-show-designer-6-crack-fixed/
    • https://www.siriusarchitects.com/advert/bully-scholarship-edition-nude-mod/
    • https://gobigup.com/wp-content/uploads/2022/07/PrintfilCrackCodes513_HOT.pdf
    • https://www.simonefiocco.com/index.php/2022/07/02/spaceshuttlemissionsimulatornocdcrack-new/
    • https://plumive.com/upload/files/2022/07/FQgnFBsddjgrT3hzvQSH_02_9d7d24b6f49325422104e77463298376_file.pdf
    • https://voiccing.com/upload/files/2022/07/FCrJiF9pZqKkSWDbKPor_02_9d7d24b6f49325422104e77463298376_file.pdf
    • https://rocky-wave-27405.herokuapp.com/keaglo.pdf
    • http://www.easytable.online/wp-content/uploads/2022/07/Descargar_Mecasoft_Pro_60_Crack_LINK_Serial_.pdf
    • https://dsdp.site/it/?p=21753
    • http://www.chemfreecarpetcleaning.com/?p=17951
    • http://sharedsuccessglobal.com/marketplace/upload/files/2022/07/CkyvtV2hgN54w4SqzWiC_02_ffc2b2a464d270d805cac47e8b9cb933_file.pdf
    • https://ebbsarrivals.com/2022/07/02/codex-impero-tau-ita-link/
    • https://audriafreeju.wixsite.com/vetastgapa/post/omsi2addonmetropoleruhrextra-quality-crackdll
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.