PDF static analysis report

Static analysis result for SHA-256 01aa7d548729c123…

SUSPICIOUS

PDF

252.8 KB Created: 2022-07-06 03:11:46 +00:00 Authoring application: vayngu (via PDF Master 1.0.1) First seen: 2026-06-01
MD5: a088c453e08967ddafe57b96f2fa602a SHA-1: 704bd0fa943b6880b4c0f5c8b1574743639db482 SHA-256: 01aa7d548729c123cbec208e3445b01a7f337d673f612aa325521434af1662a3
52 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0071

Heuristics 4

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blogbasters.com/ambled/entrapment.revolved.ZG93bmxvYWR8eHQxTkd4cVozeDhNVFkxTnpBMk56RTFOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/QmF0bWFuIEFya2hhbSBDaXR5IEJsYWNrYm94IFJlcGFjayBDcmFjayA1MAQmF/micro/ PDF link annotation
    • https://cosmonet.club/upload/files/2022/07/VEk2PMItmBIoL28cRYP8_06_dde52abbf3e86ae182f932aa947b93c7_file.pdfIn PDF document text
    • https://ceza.gov.ph/system/files/webform/resume/lotofacilprofessional80serialnumber.pdfIn PDF document text
    • http://emforma.cm-amadora.pt/blog/index.php?entryid=5568In PDF document text
    • https://www.careion.be/sites/default/files/webform/readiris-pro-10-keygen-download.pdfIn PDF document text
    • https://www.ladiesbusinessdirectory.com/wp-content/uploads/2022/07/SaanseinTheLastBreathmovieenglishsubtitlesdownloadformovie.pdfIn PDF document text
    • http://boomingbacolod.com/?p=14998In PDF document text
    • https://www.nzangoartistresidency.com/is-456-code-1978-free-__link__-download-pdf/In PDF document text
    • http://freemall.jp/viking-adventures-super-pack-final-2014-pc-foxy-games-crack-free-portable.htmlIn PDF document text
    • https://arteshantalnails.com/wp-content/uploads/2022/07/fabreart.pdfIn PDF document text
    • https://waappitalk.com/upload/files/2022/07/i4en1jrtWzG4nsrjZpvW_06_dde52abbf3e86ae182f932aa947b93c7_file.pdfIn PDF document text
    • https://testthiswebsite123.com/2022/07/06/nuclear-evb-eng-4-1-1-jro03c-20130416-test-keys-img-verified/In PDF document text
    • http://minnesotafamilyphotos.com/gp-pro-ex-software-free-download-top/In PDF document text
    • https://youdocz.com/wp-content/uploads/2022/07/Aata_Aarambam_Telugu_Full_TOP_Movie_Hd_1080p_Blu_Ray_Download.pdfIn PDF document text
    • http://www.terrainsprives.com/wp-content/uploads/2022/07/Borderlands_Game_Of_The_Year_Edition_repack_Mr_DJ_with_lucky-1.pdfIn PDF document text
    • https://kmtu82.org/iamlegend2onlinesaprevodom-hot/In PDF document text
    • http://fritec-doettingen.ch/?p=25900In PDF document text
    • https://dhakahalalfood-otaku.com/dino-crisis-2-pc-game-hot-download/In PDF document text
    • https://cosmonet.club/upload/files/2022/07/VEk2PMItmBIoL28cRYP8_06_dde52abbf3e86ae182f932aa947b93c7In PDF document text
    • https://www.ladiesbusinessdirectory.com/wp-In PDF document text
    • https://waappitalk.com/upload/files/2022/07/i4en1jrtWzG4nsrjZpvW_06_dde52abbf3e86ae182f932aa947b93c7In PDF document text
    • https://youdocz.com/wp-In PDF document text
    • http://www.terrainsprives.com/wp-In PDF document text
    • https://niadeggalataxe.wixsite.com/quevaslirec/post/qhm8106-usb-lan-card-driver-125-repackIn PDF document text
    • https://trello.com/c/jH8DBzM7/100-assassinscreed3v101plus9trainer-fling-game-hack-linkIn PDF document text
    • https://wakelet.com/wake/otJOpr3bNS63XCMPvn8tZIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A4F 86436 bytes
SHA-256: b5b00b4664c303968e50168935ad1b351296206ab44111abd667b0a5a4345872
font_01_sfnt_off0000b784.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB784 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.