PDF static analysis report

Static analysis result for SHA-256 dfeeebcc22314d27…

SUSPICIOUS

PDF

118.5 KB Created: 2022-07-04 05:43:31 +00:00 Authoring application: maliweth (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 3ba6bb92a852b32055179b819de234e0 SHA-1: 286d20ffe01960112ffbc3823b7b9ce367cfd850 SHA-256: dfeeebcc22314d276ee45e0b6d68a03414bf9a66eb308f639ab2d2e9b99c3845
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a remote GoTo action and multiple embedded URIs, with one heuristic specifically identifying links advertising cracked software. The primary URL, http://thedirsite.com/ofna/babylonian.arimathea?..., appears to be a download link for a malicious payload. While no scripts were extracted, the PDF structure and embedded links strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier clean score 0.0127

Heuristics 4

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thedirsite.com/ofna/babylonian.arimathea?infirmed/muslin/ZG93bmxvYWR8emI0T0dkc2JueDhNVFkxTmpnNU1qTTFNbng4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/Zm9vIGxvZ2l0ZWNoIGxjZAZm9/shackleford PDF link annotation
    • https://evening-temple-39143.herokuapp.com/GStock_Photo.pdfIn PDF document text
    • http://rootwordsmusic.com/2022/07/04/earthquake-bulletin-7-0-01-crack-lifetime-activation-code-mac-win/In PDF document text
    • https://volektravel.com/wp-content/uploads/2022/07/EFit__Free_Edition_Portable__With_Key_MacWin.pdfIn PDF document text
    • https://nelsonescobar.site/wp-content/uploads/2022/07/nirvedmu.pdfIn PDF document text
    • https://www.arunachalreflector.com/2022/07/04/catia-screensaver-crack-x64-updated/In PDF document text
    • https://dawnintheworld.net/pixo-2-0-1-download-win-mac-latest/In PDF document text
    • https://gameurnews.fr/upload/files/2022/07/2ekyLjalo25tNFzzQhca_04_b489895fd4a59c368833e4b99e5ec28a_file.pdfIn PDF document text
    • http://connect.tg/wp-content/uploads/2022/07/desodel.pdfIn PDF document text
    • https://spaziofeste.it/wp-content/uploads/MemPad.pdfIn PDF document text
    • https://www.condommessage.com/wp-content/uploads/2022/07/makpea.pdfIn PDF document text
    • https://www.villageofbronxville.com/sites/g/files/vyhlif336/f/file/file/chap_216_peddling_and_soliciting.pdfIn PDF document text
    • https://www.townofgb.org/sites/g/files/vyhlif636/f/uploads/parks_usage_request_form_and_instructions_2017.pdfIn PDF document text
    • https://humansofkarnataka.com/cryptapix-free-pc-windows/In PDF document text
    • https://techadarsh.com/2022/07/04/super-launcher-1-2-4-0-crack-with-product-key-free-download-latest-2022/In PDF document text
    • https://luvmarv.com/2022/07/04/securemailer-for-windows-crack-for-windows/In PDF document text
    • http://slovenija-lepa.si/wp-content/uploads/2022/07/dorvin.pdfIn PDF document text
    • https://parsiangroup.ca/2022/07/magicplot-calculator-crack-x64/In PDF document text
    • http://rootwordsmusic.com/2022/07/04/earthquake-bulletin-7-0-01-crack-lifetime-activation-code-In PDF document text
    • https://volektravel.com/wp-In PDF document text
    • https://gameurnews.fr/upload/files/2022/07/2ekyLjalo25tNFzzQhca_04_b489895fd4a59c368833e4b9In PDF document text
    • https://www.villageofbronxville.com/sites/g/files/vyhlif336/f/file/file/chap_216_peddling_and_solicitingIn PDF document text
    • https://www.townofgb.org/sites/g/files/vyhlif636/f/uploads/parks_usage_request_form_and_instructionIn PDF document text
    • https://techadarsh.com/2022/07/04/super-launcher-1-2-4-0-crack-with-product-key-free-download-In PDF document text
    • http://guychesco.yolasite.com/resources/Simply-XPMC-Induztry--With-Full-Keygen-Free-Download.pdfIn PDF document text
    • https://www.mcgill.ca/thoracic/system/files/webform/ellnic465.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
    • http://guychesco.yolasite.com/resources/simply-xpmc-induztry--with-full-keygen-free-download.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.