Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1b3259cadcfb807…

MALICIOUS

PDF

145.1 KB Created: 2022-06-08 03:53:22 +02:00 Authoring application: chaueid (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: f3b542eff47366d067ea8a6fe745eae0 SHA-1: 17c57b0bd36ca4c6a8e19783b26dd2c8ff2e0e36 SHA-256: e1b3259cadcfb8075635ae29bd9f3d4103e325abe2ed825bb08e827108d935a7
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which appear to be SEO-optimized lures for downloading cracked software or other potentially unwanted files. The heuristic PDF_SEO_LINK_FARM indicates a deliberate attempt to create a link farm, likely to distribute malware or facilitate phishing. The primary IOC is the first external URI found, which leads to a base64 encoded string that decodes to a download URL.

Machine Learning

  • Nyx PDF Classifier clean score 0.0066

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/alexandra/V2luIFVwZGF0ZSBGaXhlcgV2l/braintree/aren/edonkey/gamelan=ZG93bmxvYWR8M0NITm1GdGVIeDhNVFkxTkRZME16TTFNSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/genioglossus/compensates/
    • http://www.neorestaurantqatar.com/wp-content/uploads/2022/06/EMM_Knagalis_Activation_Code_Free.pdf
    • https://www.iplhindinews.com/easy-youtube-downloader-crack-2022/
    • https://fatroiberica.es/wp-content/uploads/2022/06/Gravitomagnetic_Calculator__Crack_.pdf
    • https://silkfromvietnam.com/http-portcom-crack-license-code-keygen-for-pc/
    • http://giovanimaestri.com/?p=5196
    • http://www.vanquisherstcg.com/?p=80495
    • http://www.caribbeanequipmenttraders.com/wp-content/uploads/2022/06/Prof_Shutdown_LT__Crack__Latest.pdf
    • http://www.ourartworld.com/executeit-patch-with-serial-key/
    • https://4j90.com/skype-glass-icon-booster-pack-crack-with-keygen-download-updated/
    • https://www.beaches-lakesides.com/realestate/lwall-reinforcement-of-l-retaining-walls-crack/
    • https://luvmarv.com/?p=27470
    • https://gravesendflorist.com/java-doc-server-crack-with-full-keygen/
    • http://www.reiten-scheickgut.at/pos-maid-crack-2022/
    • https://chatbook.pk/upload/files/2022/06/MKaaliVTpE8M7a1ylNDM_08_3c860b7bb45382ab862b58bea829cba7_file.pdf
    • https://paddock.trke.rs/upload/files/2022/06/AoRcFu33lJ7ROE3aVraG_08_3c860b7bb45382ab862b58bea829cba7_file.pdf
    • https://www.weactgreen.com/upload/files/2022/06/9MMkKnzfvLl8xyglsvtF_08_3c860b7bb45382ab862b58bea829cba7_file.pdf
    • https://shiphighline.com/disk-medic-crack-download/
    • https://social.wepoc.io/upload/files/2022/06/y1Mkxi4ElMsLc5QG1HvQ_08_3fe9b70ceca02698413d5b9c4665a610_file.pdf
    • https://www.onk-group.com/total-pdf-printer-1-50-crack-pc-windows-2022-latest/
    • https://elegatestore.com/wp-content/uploads/2022/06/ExchangeCompress_Crack__MacWin.pdf
    • http://www.caribbeanequipmenttraders.com/wp-
    • https://chatbook.pk/upload/files/2022/06/MKaaliVTpE8M7a1ylNDM_08_3c860b7bb45382ab862b58bea829cb
    • https://paddock.trke.rs/upload/files/2022/06/AoRcFu33lJ7ROE3aVraG_08_3c860b7bb45382ab862b58bea829c
    • https://www.weactgreen.com/upload/files/2022/06/9MMkKnzfvLl8xyglsvtF_08_3c860b7bb45382ab862b58bea
    • https://social.wepoc.io/upload/files/2022/06/y1Mkxi4ElMsLc5QG1HvQ_08_3fe9b70ceca02698413d5b9c4665
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_006_off000031d3.bin
a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x31D3 120140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.