Malicious PDF — malware analysis report

Static analysis result for SHA-256 029906bf698a0318…

MALICIOUS

PDF

112.5 KB Created: 2022-09-09 09:40:43 +00:00 Authoring application: wylechry (via PDF Master 1.0.1) First seen: 2026-05-08
MD5: a4ea40a4f6fd8c82338d87b2a456d64f SHA-1: dd0ab8fa8db26f992f5cfbf326236fbfc13060fa SHA-256: 029906bf698a0318342fa2cbf1471ad3ac7f4d7fdebb2cad388927909fddba5d
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0014

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://signforcover.com/wiggling/cHJvMTAwIDUgMTggY3ogY3JhY2scHJ.ZG93bmxvYWR8UkYwTmpSdGRIeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA?fleshiness=chocolates&incriminating=rustoleum& PDF link annotation
    • https://mighty-oasis-72445.herokuapp.com/it_skills_standard_vellum_setup_free.pdfIn PDF document text
    • http://gc.pknowledge.eu/wp-content/uploads/2022/09/Codetwo_Office_365_Migration_Keygen_Crack_PORTABLE.pdfIn PDF document text
    • https://arseducation.com/biokey-200-fingerprint-scanner-driver-for-windows-7-32-bit-free-full-download/In PDF document text
    • https://alafdaljo.com/download-install-teorija-zavere-pdf-dejan-lucic/In PDF document text
    • https://limitless-sierra-56099.herokuapp.com/SeDiv_2350_hard_drive_repair_tool_FULL_VERSION_hit.pdfIn PDF document text
    • https://desolate-bayou-71130.herokuapp.com/FULL_Corte_Certo_v39_204.pdfIn PDF document text
    • https://morning-cliffs-18268.herokuapp.com/Video_Chika_Foto_Chika_Dan_Bokep_3gp_Chika_Bandungzip.pdfIn PDF document text
    • https://www.hhlacademy.com/advert/pro-evolution-soccer-2012-demo-unlocker-ali213-free/In PDF document text
    • http://pacificgoods.net/wp-content/uploads/2022/09/Algorithm_Movie_In_Hindi_Dubbed_Free_Download_LINK.pdfIn PDF document text
    • https://klassenispil.dk/storulio-nuotykiai-free-download-upd/In PDF document text
    • https://blu-realestate.com/mdbootstrap-4-11-0-pro-all-templates-gulp-full/In PDF document text
    • http://www.diarioelsoldecusco.com/advert/epson-px730wd-adjustment-program-free-hot-hit-2/In PDF document text
    • https://businessbooster.page/wp-content/uploads/2022/09/Nokia_Phone_Unlocker_Full_Versionl_TOP.pdfIn PDF document text
    • https://parisine.com/wp-content/uploads/2022/09/720p_Dual_Audio_Movies_Tanu_Weds_Manu_3.pdfIn PDF document text
    • https://alafdaljo.com/wp-content/uploads/2022/09/Astm_D2074_07_Pdf_Download_TOP.pdfIn PDF document text
    • http://www.threadforthought.net/wp-content/uploads/fidekris.pdfIn PDF document text
    • https://gentle-cove-96956.herokuapp.com/olygau.pdfIn PDF document text
    • https://www.bywegener.dk/wp-content/uploads/2022/09/cheat_go_fishing_facebook_free.pdfIn PDF document text
    • http://vesinhnhatrang.com/?p=17853In PDF document text
    • https://breakingnewsandreligion.online/wp-content/uploads/2022/09/isabforr.pdfIn PDF document text
    • http://signforcover.com/wiggling/chjvmtawidugmtggy3ogy3jhy2schj.zg93bmxvywr8ukywtmpsdgriedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda?fleshiness=chocolates&incriminating=rustoleum&In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001533.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1533 84648 bytes
SHA-256: 0b6c48f6a4e931a4572b13bb2af9ad514b0702ea3c747f8534c05d2c57946ed4
font_01_sfnt_off00009d96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9D96 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261