Malicious PDF — malware analysis report

Static analysis result for SHA-256 01e1c7e99da2b4af…

MALICIOUS

PDF

117.9 KB Created: 2022-09-13 09:58:36 +00:00 Authoring application: wambpatr (via PDF Master 1.0.1) First seen: 2026-05-02
MD5: 7728ce0fbfc4403f6d7dbfa36e6ed9d4 SHA-1: 891e89bcf1ce8777333d6f03762c59176d828ab1 SHA-256: 01e1c7e99da2b4af51597f75abe41f6fd2d68f0d210dd15544265ead8c9560f0
264 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document functions as a link farm, containing numerous links to websites that advertise cracked software and license keys. The primary URL, http://seachtop.com/..., appears to be a download gateway obfuscated with base64, which decodes to 'ESET NOD32 LICENSE KEY 2021 Newest Key Update Nod32 Key 2020ES'. This strongly suggests the document's purpose is to lure users into downloading potentially malicious software disguised as legitimate cracked applications or license activators.

Machine Learning

  • Nyx PDF Classifier clean score 0.0018

Heuristics 8

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
    PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
  • PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
    PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seachtop.com/ZG93bmxvYWR8UDROTVd4eE5YZDhmREUyTmpJMk9EQXpPVEI4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk.gred.assess/RVNFVCBOT0QzMiBMSUNFTlNFIEtFWSAyMDIxIE5ld2VzdCBLZXkgVXBkYXRlIE5vZDMyIEtleSAyMDIwRVN/persuasion/juvenile/suggests.topiaries PDF link annotation
    • https://www.babygotbotcourses.com/wp-content/uploads/2022/09/MiTek_WoodEngine_2011_5_1_21_4_Activatorrar.pdfIn PDF document text
    • https://ferramentariasc.com/2022/09/13/full-download-superman-returns-pc-game-highly-compressed/In PDF document text
    • https://pur-essen.info/2022/09/13/corel-paintshop-pro-2020-22-2-0-8-crack-with-license-key-2020-updated/In PDF document text
    • https://stellarismods.com/wp-content/uploads/2022/09/nercar.pdfIn PDF document text
    • https://hard-times.us/wp-content/uploads/2022/09/astro_vision_lifesign_125_with_key.pdfIn PDF document text
    • https://jyotienterprises.net/wp-content/uploads/2022/09/QuickBooks_Enterprise_Solutions_140_R1_UK_Free_Download_LINK.pdfIn PDF document text
    • http://psychomotorsports.com/?p=66742In PDF document text
    • https://anyjobber.com/hot-download-kitab-primbon-betaljemur-adammakna-pdf/In PDF document text
    • https://thelacypost.com/beatedit-for-premiere-pro-zip/In PDF document text
    • https://greenearthcannaceuticals.com/euro-truck-simulator-otobus-modu-indir-patched/In PDF document text
    • https://hotelforestia.fr/?p=44993In PDF document text
    • https://poweredblack.com/wp-content/uploads/2022/09/TopoCAD_v143_Crack_serial_keygen_cd_keyrar.pdfIn PDF document text
    • https://okutimur.com/wp-content/uploads/2022/09/globo_fleet_cc_plus_262fullrar-1.pdfIn PDF document text
    • https://teenmemorywall.com/wp-content/uploads/2022/09/macnin.pdfIn PDF document text
    • https://arlingtonliquorpackagestore.com/ninjagram-license-hot/In PDF document text
    • http://jasminwinter.com/wii-xenoblade-chronicles-iso-fre/In PDF document text
    • https://vendredeslivres.com/wp-content/uploads/2022/09/Miracle_Box_Crack_193_Free_19_BEST.pdfIn PDF document text
    • https://www.asv-ventabren.fr/wp-content/uploads/2022/09/Sid_Meiers_Civilization_VI_Digital_Deluxe_v_100220_DLCs_Cheat_Engine_HOT.pdfIn PDF document text
    • https://jwmarine.org/defensa-holandesa-ajedrez-pdf-download-free/In PDF document text
    • http://steamworksedmonton.com/civil-3d-2013-x64-64bit-product-key-and-xforce-link-keygen-2/In PDF document text
    • https://www.babygotbotcourses.com/wp-content/uploads/2022/09/MiTIn PDF document text
    • https://ferramentariasc.com/2022/09/13/full-download-superman-In PDF document text
    • https://pur-essen.info/2022/09/13/corel-paintshop-In PDF document text
    • https://hard-times.us/wp-In PDF document text
    • https://jyotienterprises.net/wp-content/uploads/2022/09/QuickBooks_EIn PDF document text
    • https://anyjobber.com/hot-download-kitab-primbon-betaljemur-In PDF document text
    • https://greenearthcannaceuticals.com/euro-truck-simulator-otobus-In PDF document text
    • https://poweredblack.com/wp-content/uploads/2022/09/TopoCAD_v14In PDF document text
    • https://okutimur.com/wp-In PDF document text
    • https://vendredeslivres.com/wp-In PDF document text
    • https://www.asv-ventabren.fr/wp-content/uploads/2022/09/Sid_Meiers_In PDF document text
    • http://steamworksedmonton.com/civil-3d-2013-x64-64bit-product-key-In PDF document text
    • http://seachtop.com/zg93bmxvywr8udrotvd4ee5yzdhmreuytmpjmk9eqxppvei4zkrjmu9uqjhmq2hos1ncwgizsmtjsepsyznnz1cxae5urkpruxlcv01pqlfsrvpk.gred.assess/rvnfvcbot0qzmibmsunftlnfietfwsaymdixie5ld2vzdcblzxkgvxbkyxrlie5vzdmyietlesaymdiwrvn/persuasion/juvenile/suggests.topiariesIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001b09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B09 84648 bytes
SHA-256: 0b6c48f6a4e931a4572b13bb2af9ad514b0702ea3c747f8534c05d2c57946ed4
font_01_sfnt_off0000a36c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA36C 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261