Malicious PDF — malware analysis report

Static analysis result for SHA-256 0647121fd369bf32…

MALICIOUS

PDF

124.4 KB Created: 2022-07-01 09:43:13 +02:00 Authoring application: siobclo (via PDF Master 1.0.1) First seen: 2026-05-17
MD5: 135400fc05513fb832c476344417cad5 SHA-1: fa6fb48680543f4a8049cf71ef827db8ca703195 SHA-256: 0647121fd369bf32800301ad8c9be513a2eb01aba3db8743aa2f75e9d1672cce
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0018

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dormister.com/homering/ZG93bmxvYWR8M2l4Tm14dGIzeDhNVFkxTmpZME1EZ3hOM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/keypoints.nascar.rhizome./YWRvYmUgcGhvdG9zaG9wIGZyZWV3YXJlIGRvd25sb2FkIGZ1bGwgdmVyc2lvbgYWR?snout=sequestering PDF link annotation
    • http://jaxskateclub.org/2022/07/01/adobe-photoshop-2020-v21-5-1-full-version/In PDF document text
    • https://versiis.com/32466/photoshop-punjabi-fonts-download/In PDF document text
    • http://www.giffa.ru/who/photoshop-express-photo-editor-apk-android/In PDF document text
    • https://bytesforall.pk/system/files/webform/linntrav57.pdfIn PDF document text
    • http://manukau.biz/advert/photoshop-elements/In PDF document text
    • https://witfoodx.com/free-gradient-resources/In PDF document text
    • https://movingbay.com/photoshop-free-2018/In PDF document text
    • https://infinite-tor-15585.herokuapp.com/vector_shapes_photoshop_download.pdfIn PDF document text
    • https://myvideotoolbox.com/get-photoshop-for-windows-7-64-bit-free-download/In PDF document text
    • https://www.alnut.com/photoshop-mac-download/In PDF document text
    • https://www.gift4kids.org/wp-content/uploads/2022/07/photoshop_cs2_dds_plugin_download.pdfIn PDF document text
    • https://germanconcept.com/photoshop-csh-1712-high-quality-free-csh/In PDF document text
    • http://slimfastketo.org/?p=11383In PDF document text
    • https://fast-everglades-60371.herokuapp.com/how_to_download_photoshop_to_mac.pdfIn PDF document text
    • https://ihunt.social/upload/files/2022/07/a7f2T2nH44QKRyfvGrbX_01_d5fed92542fa681af4dbf464c1d91b5a_file.pdfIn PDF document text
    • https://amoserfotografo.com/advert/download-for-adobe-photoshop-cs4/In PDF document text
    • https://nooorasa.ru/2022/07/01/photoshop-cs3-download-full-version-for-free/In PDF document text
    • https://humansofkarnataka.com/wp-content/uploads/2022/07/jatlas.pdfIn PDF document text
    • https://thebrothers.cl/free-photoshop-button-stock-backgrounds/In PDF document text
    • http://dormister.com/homering/zg93bmxvywr8m2l4tm14dgizedhnvfkxtmpzme1ez3hom3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/keypoints.nascar.rhizome./ywrvymugcghvdg9zag9wigzyzwv3yxjligrvd25sb2fkigz1bgwgdmvyc2lvbgywr?snout=sequesteringIn PDF document text
    • https://www.sandiego.gov/system/files/webform/historical-resources-board/denndelm206.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000201d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x201D 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000ce00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCE00 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54