Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb3e4675abf143a2…

MALICIOUS

PDF

123.3 KB Created: 2022-07-05 07:31:16 +00:00 Authoring application: janneter (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: d6c11fd456b69b47f185add555e163f0 SHA-1: 9aaca38344f05d9ec3109d05f0918a7f2c794742 SHA-256: eb3e4675abf143a2b9464b727ca65e7a51957e71933d0a1e016649ed3d6ac1d0
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to PDFs advertising cracked software, such as Photoshop CS6. The PDF_URI heuristic also identified a remote GoTo action, indicating the document is designed to redirect the user to external content. The primary goal appears to be driving traffic to these software-luring sites.

Machine Learning

  • Nyx PDF Classifier clean score 0.0153

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Remote GoTo action info PDF_GOTO_REMOTE
    PDF has GoToR/GoToE actions that reference sibling document files — typical of multi-part document bundles
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dormister.com/benecke/ZG93bmxvYWR8M1JFT1dRMmRIeDhNVFkxTmprNE1UVXdOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/choosing/clonic/?wright.UGhvdG9zaG9wIENDIDIwMTUUGh&epstein=fairbanks PDF link annotation
    • https://www.gift4kids.org/wp-content/uploads/2022/07/sanwas.pdfIn PDF document text
    • https://calm-beach-06248.herokuapp.com/yedfar.pdfIn PDF document text
    • https://sheltered-falls-08025.herokuapp.com/creavir.pdfIn PDF document text
    • http://wikicando.com/wp-content/uploads/Photoshop_CS6_universal_keygen___Download_PCWindows.pdfIn PDF document text
    • https://calm-bastion-36228.herokuapp.com/Photoshop_2022_Version_231.pdfIn PDF document text
    • https://shrouded-tor-10430.herokuapp.com/alfthor.pdfIn PDF document text
    • https://mighty-hamlet-30013.herokuapp.com/Photoshop_2021_Version_222.pdfIn PDF document text
    • https://secure-savannah-29256.herokuapp.com/Adobe_Photoshop_CC_2019_version_20.pdfIn PDF document text
    • https://mighty-waters-80382.herokuapp.com/jarhal.pdfIn PDF document text
    • https://lordwillprovide.com/wp-content/uploads/2022/07/Adobe_Photoshop_CC_2015_Version_16_Activation_Code_With_Keygen_Free_For_PC_Latest.pdfIn PDF document text
    • https://travelsarkar.com/wp-content/uploads/2022/07/chejai.pdfIn PDF document text
    • https://brandyallen.com/wp-content/uploads/2022/07/Photoshop_2021_version_22_keygenexe__With_Serial_Key_Free_MacWin_Updated_2022.pdfIn PDF document text
    • https://conexionfit.net/wp-content/uploads/2022/07/henrbalf.pdfIn PDF document text
    • https://peaceful-cove-03059.herokuapp.com/caszave.pdfIn PDF document text
    • https://undergroundstudio.it/wp-content/uploads/2022/07/kalhar.pdfIn PDF document text
    • https://seo-focus.com/wp-content/uploads/2022/07/Photoshop_2020.pdfIn PDF document text
    • https://4healthynature.com/wp-content/uploads/2022/07/randjael.pdfIn PDF document text
    • https://www.zmiksowane.com/wp-content/uploads/2022/07/manttong.pdfIn PDF document text
    • https://secretcs2020.com/wp-content/uploads/2022/07/amadgran.pdfIn PDF document text
    • https://cuteteddybearpuppies.com/wp-content/uploads/2022/07/dorwes.pdfIn PDF document text
    • https://sleepy-ridge-49166.herokuapp.com/Adobe_Photoshop_CC.pdfIn PDF document text
    • http://eastleeds.online/wp-content/uploads/2022/07/baldkae.pdfIn PDF document text
    • https://stormy-escarpment-53460.herokuapp.com/jamvoj.pdfIn PDF document text
    • https://jovenesvip.com/wp-content/uploads/2022/07/counyane.pdfIn PDF document text
    • https://shipping200.com/wp-content/uploads/2022/07/Photoshop_2022_Version_2302.pdfIn PDF document text
    • http://www.gea-pn.it/wp-content/uploads/2022/07/Photoshop_2022_Version_230.pdfIn PDF document text
    • http://wikicando.com/wp-In PDF document text
    • https://lordwillprovide.com/wp-content/uploads/2022/07/Adobe_Photoshop_CC_2015_Version_16_ActivIn PDF document text
    • https://brandyallen.com/wp-content/uploads/2022/07/Photoshop_2021_version_22_keygenexe__With_In PDF document text
    • http://wikicando.com/wp-content/uploads/photoshop_cs6_universal_keygen___download_pcwindows.pdfIn PDF document text
    • https://wakelet.com/wake/PA6SFqzOhUx_skSy5CxUsIn PDF document text
    • https://wakelet.com/wake/Q3wU9b2-2XOzzpvWG6UJjIn PDF document text
    • https://wakelet.com/wake/RXQ21O4Khx26Rei8XST5hIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text