Malicious PDF — malware analysis report

Static analysis result for SHA-256 0108193acd8180f5…

MALICIOUS

PDF

125.5 KB Created: 2022-06-09 06:56:42 +02:00 Authoring application: takiel (via PDF Master 1.0.1) First seen: 2026-05-15
MD5: acdd2ce8f5f2d96d0360472a47eac915 SHA-1: c4dff8ba4e41222260bc52f9e5a8dfd4f43e4bdd SHA-256: 0108193acd8180f57e989407d98b181e7a6c3776276d4a403b3fb937652da8f8
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/exhilarating/reverberation.TkNILlNvZnR3YXJlLkV4cHJlc3MuQWNjb3VudHMuUGx1cy52NC41OS5pbmNsLmtleWdlbi5VblJFYUwuemlwTkN?saurabh=/khalil/protestant.repeater.ZG93bmxvYWR8VWMwT1dsdmVIeDhNVFkxTkRjek1EZzRObng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA PDF link annotation
    • https://nnewi.info/wp-content/uploads/2022/06/VectorMagicDesktopEditionv114fullversion.pdfIn PDF document text
    • https://www.goleisureholidays.com/wp-content/uploads/2022/06/Cytochemical_Stains_In_Hematology_Pdf_Download.pdfIn PDF document text
    • https://rexclick.com/wp-content/uploads/2022/06/chaela.pdfIn PDF document text
    • https://skinbyolga.ie/wp-content/uploads/2022/06/L_Illa_Dels_5_Fars_Pdf_Download.pdfIn PDF document text
    • https://atmecargo.com/wp-content/uploads/2022/06/RPG_Maker_MV__POP_Horror_City_Character_Pack_1_download_dire.pdfIn PDF document text
    • https://wocess.com/wp-content/uploads/2022/06/graiosbi.pdfIn PDF document text
    • https://www.2el3byazici.com/wp-content/uploads/2022/06/padgwald.pdfIn PDF document text
    • http://tirupatilist.com/wp-content/uploads/2022/06/Grand_Theft_Auto_IV__GTA_IV__V_1040_14__Crack_Razor1911.pdfIn PDF document text
    • https://delcohempco.com/2022/06/09/silenthill3gpmoviehindidubbed1/In PDF document text
    • https://lcmolds.com/wp-content/uploads/2022/06/aster_v7_activation_154.pdfIn PDF document text
    • https://www.ponuda24.com/wp-content/uploads/2022/06/anfoapo.pdfIn PDF document text
    • http://www.hva-concept.com/wp-content/uploads/2022/06/Samurai_Wish_Trainer_Download.pdfIn PDF document text
    • https://lms.makedonski.gr/blog/index.php?entryid=161In PDF document text
    • http://www.shopinrockdale.com/wp-content/uploads/2022/06/Binding_Of_Isaac_Unblocked_Hacked_Full_Game.pdfIn PDF document text
    • https://gecm.es/wp-content/uploads/2022/06/hallade.pdfIn PDF document text
    • https://merryquant.com/wp-content/uploads/2022/06/WHIRLPOOL_AWT_5088_4_Pdf_Manual.pdfIn PDF document text
    • https://www.sensoragencia.com/wp-content/uploads/2022/06/Culegere_Matematica_Ion_Petrica_Pdf_Free.pdfIn PDF document text
    • https://mycancerwiki.org/index.php/2022/06/08/incredimail-backup-pro-2-7/In PDF document text
    • https://babelson.com/wp-content/uploads/2022/06/Abhi_Saans_Lene_Ki_Fursat_Nahi_Hai_Hd_1080p.pdfIn PDF document text
    • https://atmecargo.com/wp-In PDF document text
    • http://evacdir.com/exhilarating/reverberation.tknillnvznr3yxjllkv4chjlc3muqwnjb3vudhmuugx1cy52nc41os5pbmnslmtlewdlbi5vbljfyuwuemlwtkn?saurabh=/khalil/protestant.repeater.zg93bmxvywr8vwmwt1dsdmviedhnvfkxtkrjek1ezzrobng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbdaIn PDF document text
    • https://denchoihapomidroa.wixsite.com/bergdrithinpent/post/cerita-legenda-candi-prambanan-dalam-bahasa-jawa-rargolkesIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000011a6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11A6 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000bf89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF89 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.