Malicious PDF — malware analysis report

Static analysis result for SHA-256 0182239cc99c3517…

MALICIOUS

PDF

113.3 KB Created: 2022-07-27 03:36:04 +00:00 Authoring application: fleatl (via PDF Master 1.0.1) First seen: 2026-04-08
MD5: 33d1c5992ce98b5000bad00d5bf7241e SHA-1: d54baf9b1953d92e943636db1bff411fb7b2171f SHA-256: 0182239cc99c351786e0a65f25da12e4d3c7ef011f5791840ef02341f21e6930
264 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 9

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
    PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
  • PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
    PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://esecuritys.com/ZG93bmxvYWR8ckEyTkdGak9IeDhNVFkxT0RJeE9UUTNNM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/immobilizer/U2FwaWVuIFBvd2Vyc2hlbGwgU3R1ZGlvIENyYWNrU2F.reliability.overinfluence./recordation/turbulence/ PDF link annotation
    • https://www.chemfreecarpetcleaning.com/autodesk-autocad-2019-x86-keygen-free-install-download/In PDF document text
    • https://grxgloves.com/top-gun-hard-lock-trainer-pc/In PDF document text
    • https://sandyssayings.com/wp-content/uploads/2022/07/tally_72_crack_for_windows_10.pdfIn PDF document text
    • https://bodhibliss.org/hari-poter-i-kamen-mudrosti-knjiga-pdf-download-cracked/In PDF document text
    • https://logocraticacademy.org/camtasia-studio-8-software-keygen-maker-high-quality/In PDF document text
    • https://earthoceanandairtravel.com/2022/07/26/watery-desktop-3d-full-39-serial-free-download-better/In PDF document text
    • https://blackbusinessdirectories.com/wp-content/uploads/2022/07/3d_Lut_Creator_Pro_Crack_UPD_Zip.pdfIn PDF document text
    • https://arteshantalnails.com/2022/07/27/lazer-e-cultura-popular-joffre-dumazedier-pdf-portable-download/In PDF document text
    • http://videogamefly.com/2022/07/27/x-force-patched-keygen-autocad-design-suite-2019-64-bit-free-download/In PDF document text
    • https://diontalent.nl/2022/07/27/hd-online-player-kaante-movie-download-best-in-hindi-720p/In PDF document text
    • https://deccan-dental.com/tamil-agarathi-pdf-free-download-new/In PDF document text
    • https://wmondemand.com/?p=29720In PDF document text
    • https://kireeste.com/shona-bible-old-testament-download-pdf-extra-quality/In PDF document text
    • https://clasificadostampa.com/advert/neerja-top-full-hd-movie-download/In PDF document text
    • http://www.teploobmenka.ru/advert/teploobmennik-titanovyj/In PDF document text
    • https://socialcaddiedev.com/full-ipswitch-whatsup-gold-premium-v14-3-1-torrent-exclusive/In PDF document text
    • https://magic-lamps.com/2022/07/27/jagged-alliance-back-in-action-trainer-1-13g-download-exclusive/In PDF document text
    • https://byggshopper.no/wp-content/uploads/2022/07/microsoft_office_xp_pro_activation_crack.pdfIn PDF document text
    • https://www.rhodiusiran.com/wp-content/uploads/2022/07/Trailer_Park_Mechanic_Download_For_Windows_7_REPACK-1.pdfIn PDF document text
    • https://moonrivernursingcareers.com/wp-content/uploads/2022/07/ermawyl.pdfIn PDF document text
    • https://earthoceanandairtravel.com/2022/07/26/watery-desktop-3d-full-39-serial-free-download-In PDF document text
    • https://blackbusinessdirectories.com/wp-In PDF document text
    • https://arteshantalnails.com/2022/07/27/lazer-e-cultura-popular-joffre-dumazedier-pdf-portable-In PDF document text
    • http://videogamefly.com/2022/07/27/x-force-patched-keygen-autocad-design-suite-2019-64-bit-free-In PDF document text
    • https://magic-lamps.com/2022/07/27/jagged-alliance-back-in-action-trainer-1-13g-download-In PDF document text
    • https://www.rhodiusiran.com/wp-In PDF document text
    • http://esecuritys.com/zg93bmxvywr8ckeytkdgak9iedhnvfkxt0rjee9uutnnm3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/immobilizer/u2fwawvuifbvd2vyc2hlbgwgu3r1zglvienyywnru2f.reliability.overinfluence./recordation/turbulence/In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_0001aeda.bin pdf-embedded-script PDF raw stream script payload at offset 0x1AEDA 4682 bytes
SHA-256: e08afb684c1b554da60e19a091a661fdc3b00625b488ad7e8f0951e61af856af
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 shell/COM execution token(s).
Preview script
First 1,000 lines of the extracted script
<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.1-c043 52.372728, 2009/01/18-15:08:04">
	<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
		<rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/">
			<dc:format>application/pdf</dc:format>
			<dc:title>
				<rdf:Alt>
					<rdf:li xml:lang="x-default">Sapien Powershell Studio _HOT_ Crack</rdf:li>
				</rdf:Alt>
			</dc:title>
			<dc:creator>
				<rdf:Seq>
					<rdf:li>fleatl</rdf:li>
				</rdf:Seq>
			</dc:creator>
			<dc:description>
				<rdf:Alt>
					<rdf:li xml:lang="x-default"></rdf:li>
				</rdf:Alt>
			</dc:description>
			<dc:subject>
				<rdf:Bag>
					<rdf:li>fleatl</rdf:li>
				</rdf:Bag>
			</dc:subject>
		</rdf:Description>
		<rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/">
			<xmp:CreateDate>2022-07-27T03:36:04+00:00</xmp:CreateDate>
			<xmp:CreatorTool>fleatl</xmp:CreatorTool>
			<xmp:ModifyDate>2022-07-27T03:36:04+00:00</xmp:ModifyDate>
			<xmp:MetadataDate>2022-07-27T03:36:04+00:00</xmp:MetadataDate>
		</rdf:Description>
		<rdf:Description rdf:about="" xmlns:pdf="http://ns.adobe.com/pdf/1.3/">
			<pdf:Keywords>fleatl</pdf:Keywords>
			<pdf:Producer>PDF Master 1.0.1</pdf:Producer>
		</rdf:Description>
		<rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">
			<xmpMM:DocumentID>uuid:42abb922-6a12-25b9-c147-e1eea9cd9203</xmpMM:DocumentID>
			<xmpMM:InstanceID>uuid:42abb922-6a12-25b9-c147-e1eea9cd9203</xmpMM:InstanceID>
		</rdf:Description>
		<rdf:Description rdf:about="" xmlns:pdfaExtension="http://www.aiim.org/pdfa/ns/extension/" xmlns:pdfaSchema="http://www.aiim.org/pdfa/ns/schema#" xmlns:pdfaProperty="http://www.aiim.org/pdfa/ns/property#">
			<pdfaExtension:schemas>
				<rdf:Bag>
					<rdf:li rdf:parseType="Resource">
						<pdfaSchema:namespaceURI>http://ns.adobe.com/pdf/1.3/</pdfaSchema:namespaceURI>
						<pdfaSchema:prefix>pdf</pdfaSchema:prefix>
						<pdfaSchema:schema>Adobe PDF Schema</pdfaSchema:schema>
						<pdfaSchema:property>
							<rdf:Seq>
								<rdf:li rdf:parseType="Resource">
									<pdfaProperty:category>internal</pdfaProperty:category>
									<pdfaProperty:description>Adobe PDF Schema</pdfaProperty:description>
									<pdfaProperty:name>InstanceID</pdfaProperty:name>
									<pdfaProperty:valueType>URI</pdfaProperty:valueType>
								</rdf:li>
							</rdf:Seq>
						</pdfaSchema:property>
					</rdf:li>
					<rdf:li rdf:parseType="Resource">
						<pdfaSchema:namespaceURI>http://ns.adobe.com/xap/1.0/mm/</pdfaSchema:namespaceURI>
						<pdfaSchema:prefix>xmpMM</pdfaSchema:prefix>
						<pdfaSchema:schema>XMP Media Management Schema</pdfaSchema:schema>
						<pdfaSchema:property>
							<rdf:Seq>
								<rdf:li rdf:parseType="Resource">
									<pdfaProperty:category>internal</pdfaProperty:category>
									<pdfaProperty:description>UUID based identifier for specific incarnation of a document</pdfaProperty:description>
									<pdfaProperty:name>InstanceID</pdfaProperty:name>
									<pdfaProperty:valueType>URI</pdfaProperty:valueType>
								</rdf:li>
							</rdf:Seq>
						</pdfaSchema:property>
					</rdf:li>
					<rdf:li rdf:parseType="Resource">
						<pdfaSchema:namespaceURI>http://www.aiim.org/pdfa/ns/id/</pdfaSchema:namespaceURI>
						<pdfaSchema:prefix>pdfaid</pdfaSchema:prefix>
						<pdfaSchema:schema>PDF/A ID Schema</pdfaSchema:schema>
						<pdfaSchema:property>
							<rdf:Seq>
								<rdf:li rdf:parseType="Resource">
									<pdfaProperty:category>internal</pdfaProperty:category>
									<pdfaProperty:description>Part of PDF/A standard</pdfaProperty:description>
									<pdfaProperty:name>part</pdfaProperty:name>
									<pdfaProperty:valueType>Integer</pdfaProperty:valueType>
								</rdf:li>
								<rdf:li rdf:parseType="Resource">
									<pdfaProperty:category>internal</pdfaProperty:category>
									<pdfaProperty:description>Amendment of PDF/A standard</pdfaProperty:description>
									<pdfaProperty:name>amd</pdfaProperty:name>
									<pdfaProperty:valueType>Text</pdfaProperty:valueType>
								</rdf:li>
								<rdf:li rdf:parseType="Resource">
									<pdfaProperty:category>internal</pdfaProperty:category>
									<pdfaProperty:description>Conformance level of PDF/A standard</pdfaProperty:description>
									<pdfaProperty:name>conformance</pdfaProperty:name>
									<pdfaProperty:valueType>Text</pdfaProperty:valueType>
								</rdf:li>
							</rdf:Seq>
						</pdfaSchema:property>
					</rdf:li>
				</rdf:Bag>
			</pdfaExtension:schemas>
		</rdf:Description>
	</rdf:RDF>
</x:xmpmeta>
<?xpacket end="w"?>
font_00_sfnt_off000010e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10E1 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off000098cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x98CD 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.