Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef00312cb80dba6b…

MALICIOUS

PDF

124.4 KB Created: 2022-06-12 17:13:38 +02:00 Authoring application: anatdar (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: da2450a9b60501bf0552e5abca8f9260 SHA-1: 402aa5bbe155215f14b8959e916eb65eb1ceaf72 SHA-256: ef00312cb80dba6be4fc8ce2b9e468c7c68241b7886bcf3d166f9449851e8663
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which appear to be SEO-optimized slugs pointing to various websites. One prominent URL, http://evacdir.com/contrive/employment.magnetism.mansilla.ZG93bmxvYWR8REM3YVhGblpIeDhNVFkxTkRrNE9URTJNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/unsaid/V2ViY2FtIFN1cnZleW9yIDMuNy4zIEJ1aWxkIDEwOTEgTXVsdGlsaW5ndWFsV2V/myopically, is likely a landing page for a malicious download or exploit. The heuristic firings indicate a link farm strategy, suggesting the document's primary purpose is to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier clean score 0.0206

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/contrive/employment.magnetism.mansilla.ZG93bmxvYWR8REM3YVhGblpIeDhNVFkxTkRrNE9URTJNbng4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/unsaid/V2ViY2FtIFN1cnZleW9yIDMuNy4zIEJ1aWxkIDEwOTEgTXVsdGlsaW5ndWFsV2V/myopically
    • https://whatsthebuzzvideo.com/wp-content/uploads/2022/06/Andaz_1971__FLAC.pdf
    • https://nuvocasa.com/ingenieria-economica-degarmo-pdf-solucionario/
    • http://www.antiquavox.it/gpu-shader-30-pes-2011-download/
    • http://www.easytable.online/wp-content/uploads/2022/06/nathalix.pdf
    • https://aumigona.com/wp-content/uploads/2022/06/Key_For_Wic_Reset_Utility_Version_V3_19.pdf
    • https://thevaluesquares.com/wp-content/uploads/2022/06/Chaturbate_Premium_And_Token_Generator_V4_21_Activation_Key.pdf
    • https://www.spasvseyarusi.ru/advert/steinberg-cubase-7-5-keygen-exclusive-19/
    • https://magic-lamps.com/2022/06/12/the-call-finding-and-fulfilling-the-central-purpose-of-your-life-download-zip-verified/
    • https://solaceforwomen.com/byond-darkwizard-rsc-extractor-4-0-rar/
    • https://www.hony.nl/wp-content/uploads/Red_Faction_II_download_for_pc_highly_compressed.pdf
    • https://dry-cliffs-59470.herokuapp.com/Architecture_Portfolio_Template_Free_Download.pdf
    • https://www.surfcentertarifa.com/onone-perfect-resize-7-5-keygen-11/
    • https://aqueous-wildwood-01647.herokuapp.com/reign_s01e07_720p_or_1080p.pdf
    • https://panda-app.de/upload/files/2022/06/yKz2ZpCCqQeJvX1RRmuw_12_59044b81f938bcf31a45eed60734be0d_file.pdf
    • https://brightsun.co/wp-content/uploads/2022/06/Twinbridge_Chinese_Partner_V65_Premium_Edition_Fo.pdf
    • https://classifieds.aramsco.com/advert/2012-chevey-van-2500-extended-and-hydromaster-575-titan/
    • https://stormy-badlands-07735.herokuapp.com/Fan_dubbed_in_hindi_download_torrent.pdf
    • https://firmateated.com/2022/06/12/with-joyful-lips-hymn-book-download/
    • https://obeenetworkdev.s3.amazonaws.com/upload/files/2022/06/ZmbwlvpZ4cM4HzvOAYbK_12_cc2fef353c943a82706116dedd542961_file.pdf
    • http://goodidea.altervista.org/advert/proteus-software-free-download-with-crack-for-windows-7-32-bit-upd/
    • http://www.tcpdf.org
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000efc.bin
a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xEFC 120140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.