Malicious PDF — malware analysis report

Static analysis result for SHA-256 eab661502d93da84…

MALICIOUS

PDF

136.4 KB Created: 2022-07-08 02:19:47 +00:00 Authoring application: dejasamu (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 435ef558878600815bd58106566eaec0 SHA-1: c75d06f6d4bb4604d1a52331f8165d980250e1be SHA-256: eab661502d93da84e72a12c3b7d11f0660dc8efd68d9f1ee9f94ffc3c4e759b9
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links to other PDF files, a technique often used to inflate search engine rankings and distribute malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, with the primary malicious URL being http://godsearchs.com/... The document body is heavily obfuscated and does not provide clear textual lures, but the presence of numerous links to potentially malicious PDFs strongly suggests a distribution or redirection scheme.

Machine Learning

  • Nyx PDF Classifier clean score 0.0094

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://godsearchs.com/agonizing/arteriole=closer/R3JhdmUgRW5jb3VudGVycyAxMDgwcCBZaWZ5IFN1YnRpdGxlcyAyMgR3J=diarrhoea/leuvensesteenweg.ZG93bmxvYWR8Z2o3WTJ4aWQzeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA PDF link annotation
    • https://ideatranslate.ru/fr/system/files/webform/spss-19-serial-key.pdfIn PDF document text
    • https://www.tailormade-logistics.com/sites/default/files/webform/tarraw158.pdfIn PDF document text
    • https://lyricsandtunes.com/wp-content/uploads/2022/07/prinuldr.pdfIn PDF document text
    • https://you.worldcruiseacademy.co.id/upload/files/2022/07/2QBI9sq2swx86vjugVvB_08_eba85880871b97a8a10302bc2968cee5_file.pdfIn PDF document text
    • http://hominginportland.com/?p=10765In PDF document text
    • https://training.cybersecurityinstitute.co.za/blog/index.php?entryid=6154In PDF document text
    • https://alessiomastroianni.com/operating-system-by-gary-nutt-free-downloadrar-hot/In PDF document text
    • https://mimaachat.com/upload/files/2022/07/xoJM7yv9GWbSa6XILykY_08_89234a3a1fdc366e7a0e48a45730bbfe_file.pdfIn PDF document text
    • https://www.careion.be/sites/default/files/webform/tagtala539.pdfIn PDF document text
    • https://www.vsv7.com/upload/files/2022/07/2XIrtQW5IwNorLSdeYPR_08_6c4be5d11b4a071e323d03bfb3be8372_file.pdfIn PDF document text
    • http://igpsclub.ru/social/upload/files/2022/07/5GA8hKVaYYJPJUOdswGu_08_eba85880871b97a8a10302bc2968cee5_file.pdfIn PDF document text
    • https://shalamonduke.com/wp-content/uploads/2022/07/POSTAL_Redux__Official_Soundtrack_Free_Download_Ativador.pdfIn PDF document text
    • https://limeti.com.mx/foro//upload/files/2022/07/B7pCZJ8D893vidkxlmCf_08_89234a3a1fdc366e7a0e48a45730bbfe_file.pdfIn PDF document text
    • https://papayu.co/anthony-romeno-feat-jaze-knight-my-home-zippy-top-2/In PDF document text
    • https://waappitalk.com/upload/files/2022/07/Kab5y7H9N1Ds7GYPW6EY_08_eba85880871b97a8a10302bc2968cee5_file.pdfIn PDF document text
    • https://levitra-gg.com/?p=19544In PDF document text
    • https://www.amphenolalden.com/system/files/webform/octaharl237.pdfIn PDF document text
    • https://you.worldcruiseacademy.co.id/upload/files/2022/07/2QBI9sq2swx86vjugVvB_08_eba8588087In PDF document text
    • https://mimaachat.com/upload/files/2022/07/xoJM7yv9GWbSa6XILykY_08_89234a3a1fdc366e7a0e48In PDF document text
    • https://www.vsv7.com/upload/files/2022/07/2XIrtQW5IwNorLSdeYPR_08_6c4be5d11b4a071e323d03bIn PDF document text
    • http://igpsclub.ru/social/upload/files/2022/07/5GA8hKVaYYJPJUOdswGu_08_eba85880871b97a8a1030In PDF document text
    • https://shalamonduke.com/wp-In PDF document text
    • https://limeti.com.mx/foro//upload/files/2022/07/B7pCZJ8D893vidkxlmCf_08_89234a3a1fdc366e7a0eIn PDF document text
    • https://waappitalk.com/upload/files/2022/07/Kab5y7H9N1Ds7GYPW6EY_08_eba85880871b97a8a103In PDF document text
    • https://sigs.interserver.net/blocked?ref=aiplgurugram.com/?p=17605In PDF document text
    • https://trello.com/c/pxl49bQi/58-kaakan-marathi-movie-download-dvdrip-201-topIn PDF document text
    • https://elprohookeridut.wixsite.com/pupletata/post/advanced-c-programming-by-example-john-w-perry-pdf-15In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://elprohookeridut.wixsite.com/pupletata/post/advanced-c-programming-by-example-john-w-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.