Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9252be7372f4422…

MALICIOUS

PDF

82.2 KB Created: 2022-06-10 05:42:13 +02:00 Authoring application: vucmil (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 2b32f0733c3e5496038aa1370a960560 SHA-1: b103e6cb1ef4ca08ba063d6f8bddb3ca01d4c758 SHA-256: e9252be7372f4422aa9510ee2cc202e56b3d5170669e81fbae4178703f600cdf
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of external links, many of which advertise cracked software, indicating a lure for users to download potentially malicious files. The heuristic firings suggest this PDF is part of a link farm designed to distribute such content. No scripts were extracted from this sample, limiting further analysis of its execution behavior.

Machine Learning

  • Nyx PDF Classifier clean score 0.2051

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/dml2YXggZmlybXdhcmUgMTkdml.creamers.benoticeable/chilliwack.ZG93bmxvYWR8dmYxTjJObGQzeDhNVFkxTkRjNE1EZzNPWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/isas/mihira/muttering PDF link annotation
    • https://triberhub.com/upload/files/2022/06/fozT2EZfdGblIxqOm2XD_10_10c445056a10bb313e31dc80d14f051d_file.pdfIn PDF document text
    • https://www.dominionphone.com/wp-content/uploads/2022/06/ToneBoosters_All_Plugins_Bundle_V303_VST_WIN_OSX_Incl_KeyGen.pdfIn PDF document text
    • https://myfairytale.blog/wp-content/uploads/2022/06/lauana.pdfIn PDF document text
    • http://www.readbutneverred.com/wp-content/uploads/2022/06/jaynar.pdfIn PDF document text
    • https://sfinancialsolutions.com/download-komik-tiger-wong-teks-indonesia-install/In PDF document text
    • https://setewindowblinds.com/wp-content/uploads/2022/06/FileMaker_Pro_Advanced_1201_Portable.pdfIn PDF document text
    • https://facenock.com/upload/files/2022/06/L69dImrcPb1C9jeMu3qq_10_10c445056a10bb313e31dc80d14f051d_file.pdfIn PDF document text
    • http://homeprosinsulation.com/wp-content/uploads/2022/06/flobian.pdfIn PDF document text
    • https://mentorthis.s3.amazonaws.com/upload/files/2022/06/OfKK4wlNPG5LhfjYQLcZ_10_10c445056a10bb313e31dc80d14f051d_file.pdfIn PDF document text
    • https://fraenkische-rezepte.com/wp-content/uploads/2022/06/Dragon_Quest_Monsters_Joker_2_Pro.pdfIn PDF document text
    • https://www.theblender.it/counter-strike-global-offensive-v1-34-6-0-no-steam-crack-free/In PDF document text
    • http://www.skyhave.com/upload/files/2022/06/v6fg9bbGooK4db2Z3fqe_10_adeef31f9ddeafc79287dbeacaf2751a_file.pdfIn PDF document text
    • https://svistok.org/2022/06/10/ninite-pro-full-crack-150/In PDF document text
    • https://www.agrofacil.co/wp-content/uploads/2022/06/brisand.pdfIn PDF document text
    • https://wakandaplace.com/wp-content/uploads/2022/06/Auto_Mouse_Mover_Registration_Key_Free_Download.pdfIn PDF document text
    • https://luathoanhao.com/wp-content/uploads/2022/06/Pds_2000_Crack_Full.pdfIn PDF document text
    • https://myirishconnections.com/wp-content/uploads/2022/06/Crack_MP3_Splitter_Joiner_Pro_5_1_PATCHED.pdfIn PDF document text
    • https://getinfit.ru/magazine/beckhoff-twincat-2-11-keygenlIn PDF document text
    • https://entrelink.hk/political/billa-2-cracked-full-movie-hd-1080p-blu-ray-tamil/In PDF document text
    • https://www.centerlb.org/wp-content/uploads/2022/06/Train_To_Busan_2_Movie_Hd_720p_Download_NEW.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000018ad.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18AD 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.