Malicious PDF — malware analysis report

Static analysis result for SHA-256 f48fff7e768fa84a…

MALICIOUS

PDF

122.2 KB Created: 2022-07-08 07:13:53 +00:00 Authoring application: aleeiman (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: bfb6483ca3f8051e9f2767718a1fbf00 SHA-1: bfc64863a383402b6c1bbeab7e690310e3d46b91 SHA-256: f48fff7e768fa84a4b72bad4c4f7faa057a3bfa479d69efd126d7b30b3525271
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are identified as advertising cracked or pirated software. This suggests the document is designed to lure users into visiting these sites, potentially leading to malware downloads or further compromise. The embedded URLs and the heuristic findings strongly indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier clean score 0.0156

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://findinform.com/compunds/itinerant/flimsier/podolski/ZG93bmxvYWR8ODZpYW14a2MzeDhNVFkxTnpFNE5qazFOWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/scholar/snowmobile.QnVpbGR3aW4gbWVkaWEgcGxheWVyIHVzYiBkZXZpY2UgZHJpdmVyQnV PDF link annotation
    • http://lovelymms.com/abaqus-6-11-crack-free-license-file/In PDF document text
    • https://streetbazaaronline.com/2022/07/08/ultra-fast-receipt-printer-tm200-driver-106-updated/In PDF document text
    • http://ifurnit.ir/2022/07/08/adrianocelentanotorrent/In PDF document text
    • https://www.riseupstar.com/upload/files/2022/07/xXr8jiWUVJYYFnkBzjYn_08_3ddc7f4e7196ce7476562aadd14dbc37_file.pdfIn PDF document text
    • https://xtc-hair.com/bentley-stormcad-v8i-selectseries-2-08-11-02-75-link/In PDF document text
    • https://volektravel.com/wp-content/uploads/2022/07/yuanelon.pdfIn PDF document text
    • https://cobblerlegends.com/wp-content/uploads/2022/07/Raspberry_Pi_Mpeg2_License_Generator_Crack.pdfIn PDF document text
    • https://technospace.co.in/upload/files/2022/07/IiZIr7R3fZ2H7B6f6guL_08_eebed121b5f398ee84a0551ee046ec91_file.pdfIn PDF document text
    • https://www.supaanasolutions.com/wp-content/uploads/2022/07/Dragon_Ball_GT_DUALAUDIO_480p_HEVC.pdfIn PDF document text
    • http://www.interprys.it/patched-windows-7-ultimate-live-cd-2010-iso-408mb-best.htmlIn PDF document text
    • https://asuperlist.com/wp-content/uploads/2022/07/Turbobit_Turbo_Access_Code_EXCLUSIVE.pdfIn PDF document text
    • https://conbluetooth.net/city-navigator-europe-nt-2012-10-mapsource-download-verified-pc-2/In PDF document text
    • https://inobee.com/upload/files/2022/07/kOFUuno2lZCRFzYxXsVh_08_eebed121b5f398ee84a0551ee046ec91_file.pdfIn PDF document text
    • https://www.palpodia.com/upload/files/2022/07/xUiwKJ2nCRhTtHXECm9l_08_f449c1232c71083d7b0a82361f7a86fb_file.pdfIn PDF document text
    • https://www.recentstatus.com/upload/files/2022/07/YLp5BDstQYwinshyHlED_08_f449c1232c71083d7b0a82361f7a86fb_file.pdfIn PDF document text
    • https://dornwell.pl/wp-content/uploads/2022/07/Flobo_Hard_Disk_Repair_41_Full_Crack_Idm_HOT.pdfIn PDF document text
    • https://mimaachat.com/upload/files/2022/07/cCWEzIa47sp2qQXzWfo9_08_f449c1232c71083d7b0a82361f7a86fb_file.pdfIn PDF document text
    • https://gogathr.live/upload/files/2022/07/qTmrNRX6y99lnVBkCwQ3_08_eebed121b5f398ee84a0551ee046ec91_file.pdfIn PDF document text
    • https://www.riseupstar.com/upload/files/2022/07/xXr8jiWUVJYYFnkBzjYn_08_3ddc7f4e7196ce7476562aadd14dIn PDF document text
    • https://technospace.co.in/upload/files/2022/07/IiZIr7R3fZ2H7B6f6guL_08_eebed121b5f398ee84a0551ee046ecIn PDF document text
    • https://inobee.com/upload/files/2022/07/kOFUuno2lZCRFzYxXsVh_08_eebed121b5f398ee84a0551ee046ec91_fiIn PDF document text
    • https://www.palpodia.com/upload/files/2022/07/xUiwKJ2nCRhTtHXECm9l_08_f449c1232c71083d7b0a82361f7aIn PDF document text
    • https://www.recentstatus.com/upload/files/2022/07/YLp5BDstQYwinshyHlED_08_f449c1232c71083d7b0a82361In PDF document text
    • https://mimaachat.com/upload/files/2022/07/cCWEzIa47sp2qQXzWfo9_08_f449c1232c71083d7b0a82361f7a86In PDF document text
    • https://gogathr.live/upload/files/2022/07/qTmrNRX6y99lnVBkCwQ3_08_eebed121b5f398ee84a0551ee046ec91In PDF document text
    • https://londaturnier104vzh.wixsite.com/haybloganleu/post/mrtav-ladan-domaci-film-download-betterIn PDF document text
    • https://esgleamydelun.wixsite.com/sollafookachch/post/dum-laga-ke-haisha-movie-download-in-hindi-mp4-movies-updatedIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://esgleamydelun.wixsite.com/sollafookachch/post/dum-laga-ke-haisha-movie-download-in-hindi-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text