Malicious PDF — malware analysis report

Static analysis result for SHA-256 01a7050390c3dadc…

MALICIOUS

PDF

113.8 KB Created: 2022-09-09 12:57:55 +00:00 Authoring application: niquyene (via PDF Master 1.0.1) First seen: 2026-06-01
MD5: 93014ea11edcd4771f51f8fcab8d9329 SHA-1: 5622e67fd5b1e1aaf5b0a8c23fcd662ef22372b0 SHA-256: 01a7050390c3dadcd02e30fc066eef4984dc131f18ba30a19fa808799a379138
74 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0012

Heuristics 4

  • Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
    PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://widesearchengine.com/resp/gtluten?lapping=subplanted&QXV0b0NBRCBFbGVjdHJpY2FsIDIwMTUgMzIgYml0IGZyZWUgZG93bmxvYWQQXV=exploding&unthinking=ZG93bmxvYWR8T08yT0RnM1lueDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA PDF link annotation
    • https://ebs.co.zw/advert/wargame-red-dragon-steam-crack-__hot__/In PDF document text
    • https://best-housing.nl/wp-content/uploads/2022/09/Garota_De_Ipanema_Guitarra_Pdf_Free_LINK.pdfIn PDF document text
    • https://hidden-temple-56874.herokuapp.com/rechosmo.pdfIn PDF document text
    • https://parsiangroup.ca/2022/09/3planesoft-3d-screensavers-plus-all-in-one-80-repack-torrent/In PDF document text
    • https://www.beaches-lakesides.com/wp-content/uploads/2022/09/Acid_Music_Studio_100_Keygen_12.pdfIn PDF document text
    • https://lit-citadel-86222.herokuapp.com/Mksensation_Digital_Piano_Library_For_Kontakt_Torrent.pdfIn PDF document text
    • https://www.vakantiehuiswinkel.nl/the-settlers-3-gold-edition-patch-crack-better-serial-skidrow/In PDF document text
    • https://xn--xvaos-qta.net/wp-content/uploads/2022/09/frabeld.pdfIn PDF document text
    • https://tranquil-brook-14524.herokuapp.com/downloadmoviesin720pNoOneKilledJessica1080p.pdfIn PDF document text
    • https://donin.com.br/advert/office-2010-toolkit-2-2-3-hot-free-11/In PDF document text
    • https://careersguruji.com/adolf-hitler-tomtom-stimmen/In PDF document text
    • https://whispering-sands-70773.herokuapp.com/radiation_detection_and_measurement_4th_edition_knoll_pdf.pdfIn PDF document text
    • http://wp2-wimeta.de/ordinal-42-xlive-dll-gears-of-war/In PDF document text
    • https://www.sb20ireland.com/advert/solucionario-chopra-administracion-cadena-26-best/In PDF document text
    • https://www.dpfremovalnottingham.com/wp-content/uploads/2022/09/Risa_Tachibana_First_Photo_Book_Growing.pdfIn PDF document text
    • http://debbiejenner.nl/kabhi-alvida-naa-kehna-full-movie-720p-download-movies-link/In PDF document text
    • http://www.coussinsdeco.com/?p=11353In PDF document text
    • http://lasdocas.cl/?p=29561In PDF document text
    • https://gametimereviews.com/wp-content/uploads/2022/09/guinall.pdfIn PDF document text
    • https://ividenokkam.com/ads/advert/potent-pad-drivers-zip-free-exclusive-download/In PDF document text
    • http://widesearchengine.com/resp/gtluten?lapping=subplanted&qxv0b0nbrcbfbgvjdhjpy2fsidiwmtugmzigyml0igzyzwugzg93bmxvywqqxv=exploding&unthinking=zg93bmxvywr8t08yt0rnm1luedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbdaIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001a59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A59 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000a245.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA245 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261