Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8069f0ce344374a…

MALICIOUS

PDF

139.2 KB Created: 2022-07-05 16:52:09 +00:00 Authoring application: vasene (via PDF Master 1.0.1) First seen: 2022-07-15
MD5: 8a5839dcf5ad373ede0f1882294a7210 SHA-1: 5c1aeef434d73b19b37a5fac3d1edab77bda362e SHA-256: f8069f0ce344374ab730b1cce6bc3422dfc05ec17640f12be44b6b0f7a9dea55
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous external links, with several heuristics indicating a link farm designed to advertise cracked software. One of the embedded URLs, http://find24hs.com/dosha/buonanoce/feedmyipods/fruit/ZG93bmxvYWR8aGg5TVhVeGRueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/tatties/harmonycoaching.nicad?RmlmYSAyMgRml=, is particularly suspicious and likely serves as a download source for malicious payloads. The document body was not sufficiently readable to provide further context.

Machine Learning

  • Nyx PDF Classifier clean score 0.0045

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://find24hs.com/dosha/buonanoce/feedmyipods/fruit/ZG93bmxvYWR8aGg5TVhVeGRueDhNVFkxTnpBek5qSXlNM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/tatties/harmonycoaching.nicad?RmlmYSAyMgRml= PDF link annotation
    • https://www.sunsquare.com/system/files/webform/useruploads/fifa-22_27.pdfIn PDF document text
    • https://www.oakland-nj.org/sites/g/files/vyhlif1026/f/uploads/borough_calendar_2022.pdfIn PDF document text
    • https://fajas.club/2022/07/05/fifa-22-mac-win-2/In PDF document text
    • https://beautyprosnearme.com/fifa-22-crack-patch-x64/In PDF document text
    • https://comoemagrecerrapidoebem.com/?p=23471In PDF document text
    • https://1w74.com/fifa-22-crack-exe-file-free-download-mac-win-2022/In PDF document text
    • https://socialstudentb.s3.amazonaws.com/upload/files/2022/07/VXTiiUV9mUdw1b5dO9JY_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
    • https://poetbook.com/upload/files/2022/07/M3HyER6b1UBng4v5Ryz1_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
    • https://fpp-checkout.net/wp-content/uploads/2022/07/aleeisa.pdfIn PDF document text
    • https://mykingdomtoken.com/upload/files/2022/07/e34aKgvKQUuyrQoVFMIY_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
    • https://ictlife.vn/upload/files/2022/07/HxJMtquEKvaItDkCmFzc_05_c73db3cef1415170211b5fb97ba6a183_file.pdfIn PDF document text
    • http://staffdirect.info/wp-content/uploads/2022/07/Fifa_22_Activation___Product_Key_Full_MacWin_March2022.pdfIn PDF document text
    • https://geto.space/upload/files/2022/07/7ha4xzlMjaD7YYCKYfXR_05_94b78d48ae2ae8bffbb8f1d33d684724_file.pdfIn PDF document text
    • http://increate.net/fifa-22-with-license-key-product-key-full-download/In PDF document text
    • https://www.eclateng.com/sites/default/files/webform/Fifa-22.pdfIn PDF document text
    • https://swapandsell.net/2022/07/05/fifa-22-nulled-with-full-keygen-free-download-for-pc-latest/In PDF document text
    • https://parleafrique.com/wp-content/uploads/2022/07/choalo.pdfIn PDF document text
    • https://affiliateschools.com/upload/files/2022/07/KhyZPYZH85orWj2VLKBp_05_c73db3cef1415170211b5fb97ba6a183_file.pdfIn PDF document text
    • https://socialstudentb.s3.amazonaws.com/upload/files/2022/07/VXTiiUV9mUdw1b5dO9JY_05_94b78dIn PDF document text
    • https://poetbook.com/upload/files/2022/07/M3HyER6b1UBng4v5Ryz1_05_94b78d48ae2ae8bffbb8f1dIn PDF document text
    • https://mykingdomtoken.com/upload/files/2022/07/e34aKgvKQUuyrQoVFMIY_05_94b78d48ae2ae8bffIn PDF document text
    • https://ictlife.vn/upload/files/2022/07/HxJMtquEKvaItDkCmFzc_05_c73db3cef1415170211b5fb97ba6aIn PDF document text
    • http://staffdirect.info/wp-In PDF document text
    • https://geto.space/upload/files/2022/07/7ha4xzlMjaD7YYCKYfXR_05_94b78d48ae2ae8bffbb8f1d33d6In PDF document text
    • https://affiliateschools.com/upload/files/2022/07/KhyZPYZH85orWj2VLKBp_05_c73db3cef1415170211In PDF document text
    • https://www.bsc.es/system/files/webform/cv_employment/mygegen638.pdfIn PDF document text
    • https://brd.gov.md/sites/default/files/webform/attachments/vannail481.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples