Malicious PDF — malware analysis report

Static analysis result for SHA-256 f07be6a7f02cf51d…

MALICIOUS

PDF

125.2 KB Created: 2022-06-09 01:39:19 +02:00 Authoring application: amorlytt (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 429a0e20ea0019311a03ccef3af8b9d0 SHA-1: b79dab9963ac9bc0acd5e72f8a01b4e615d5973f SHA-256: f07be6a7f02cf51d97d02591d489af65560c710f630df80815aad1fcafa5c68c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a link farm advertising cracked software, indicating a lure to download potentially malicious files. The presence of embedded URLs and a PDF URI pointing to suspicious domains suggests an attempt to redirect users to malicious content. While no scripts were directly extracted, the overall structure and linked content point towards a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier clean score 0.0227

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/crowes/frivolously/ZG93bmxvYWR8YXYyT0RsbGZId3hOalUwTnpNd09EZzJmSHd5TlRjMGZId29UU2tnY21WaFpDMWliRzluSUZ0R1lYTjBJRWRGVGww.WmluZGFnaSBOYSBNaWxlZ2kgRG9iYXJhIEhkIE1wNCBEb3dubG9hZAWml/moncada/quenchers/ PDF link annotation
    • https://cristinalinassi.com/wp-content/uploads/Atlas_Ti_7_Full_FREE_Crack.pdfIn PDF document text
    • https://kate-mobilez.ru/wp-content/uploads/2022/06/olyjesi.pdfIn PDF document text
    • https://juncty.com/wp-content/uploads/2022/06/downloadmoviesin720pYehJawaaniHaiDeewani1080p.pdfIn PDF document text
    • https://spaziofeste.it/wp-content/uploads/Flying_Fish_Sinhala_Full_Movie_17.pdfIn PDF document text
    • https://nisharma.com/cantec-despre-mine-walt-whitman-comentariu-literar/In PDF document text
    • https://www.d360.fr/wp-content/uploads/2022/06/Ptc_Creo_Parametric_20_Torrent_Download.pdfIn PDF document text
    • https://www.riobrasilword.com/wp-content/uploads/2022/06/Download_Pakistani_Tv_Serial_Dhoop_Kinare.pdfIn PDF document text
    • https://aboutdance.com.ua/advert/sesso-con-animali-zoofiliaporno-gratis-better/In PDF document text
    • https://conexionfit.net/wp-content/uploads/2022/06/Ubrt2300_V4_17.pdfIn PDF document text
    • https://eqcompu.com/2022/06/08/satyagraha-1080p-movie-torrent/In PDF document text
    • http://tudungnakal.com/?p=4756In PDF document text
    • http://implicitbooks.com/advert/pcut-ct-1200-software-downloadl/In PDF document text
    • https://agorainsights.dev/blog/index.php?entryid=67425In PDF document text
    • https://mytown247.com/wp-content/uploads/2022/06/Traveller_advanced_c1_teacher_s_book.pdfIn PDF document text
    • https://hobiz.s3.amazonaws.com/upload/files/2022/06/9E4hS9eM92NJNVLJ2dFz_08_2b8180be5ef55985ccdf9661ba5e2e68_file.pdfIn PDF document text
    • http://www.bioloja.org/l/checklists/checklist.php?clid=1415In PDF document text
    • http://emforma.cm-amadora.pt/blog/index.php?entryid=27In PDF document text
    • https://siddhaastrology.com/baraha-10-4-crack-rar-rar-8-00m-full-link/In PDF document text
    • https://chatbook.pk/upload/files/2022/06/5zNP6ccZfPq7XMgiVZlk_08_f920a654104ac528ba5db32bff00b8ac_file.pdfIn PDF document text
    • https://hobiz.s3.amazonaws.com/upload/files/2022/06/9E4hS9eM92NJNVLJ2dFz_08_2b8180be5ef55985ccdf9661In PDF document text
    • https://chatbook.pk/upload/files/2022/06/5zNP6ccZfPq7XMgiVZlk_08_f920a654104ac528ba5db32bff00b8ac_filIn PDF document text
    • https://cristinalinassi.com/wp-content/uploads/atlas_ti_7_full_free_crack.pdfIn PDF document text
    • https://gastthowertumota.wixsite.com/inclaniloc/post/piku-download-kickass-720p-12-__link__In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00001103.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1103 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.