Malicious PDF — malware analysis report

Static analysis result for SHA-256 0986f291f1ae9e0e…

MALICIOUS

PDF

130.6 KB Created: 2022-07-02 14:51:54 +00:00 Authoring application: catwint (via PDF Master 1.0.1) First seen: 2026-05-17
MD5: eaff10b83e562d475ead0422ef73127b SHA-1: 6b51bce6d68d2b3c0d1493c9b1ed161714a7c880 SHA-256: 0986f291f1ae9e0ecd5422a54615e2451051f913f22498383c7215bad1959d84
149 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0008

Heuristics 5

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
    Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
  • PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
    PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://findthisall.com/eggnog/mideastern.SW5zaWRlIChBIExpbnRlcmlldXIpIDIwMDcgVW5yYXRlZCAxMDgwcCBCbHVSYXkgWDI2NCBBbm9YbW91cwSW5.cargill.zoku..ZG93bmxvYWR8MnNvZEdwMGZId3hOalUyTnpjeE9ERTRmSHd5TlRrd2ZId29UU2tnVjI5eVpIQnlaWE56SUZ0WVRVeFNVRU1nVmpJZ1VFUkdYUQ PDF link annotation
    • https://hidden-plateau-32753.herokuapp.com/abisula.pdfIn PDF document text
    • https://cameraitacina.com/en/system/files/webform/feedback/sharir-rachana-vigyan-pdf-free.pdfIn PDF document text
    • https://fescosecurity.com/wp-content/uploads/2022/07/Economics_Lipsey_And_Chrystal_12th_Edition_Free_Download98.pdfIn PDF document text
    • https://aposhop-online.de/2022/07/02/abbey-road-redd-consoles-vst-plugin-torrent/In PDF document text
    • https://tbone.fi/wp-content/uploads/2022/07/laveblo-1.pdfIn PDF document text
    • https://kidztopiaplay.com/wp-content/uploads/2022/07/giayes.pdfIn PDF document text
    • https://colombiasubsidio.xyz/?p=11101In PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/magkurt348.pdfIn PDF document text
    • https://natsegal.com/multiviewer-2-0-easycap-software-41/In PDF document text
    • https://harneys.blog/2022/07/02/fixed-download-archicad-16-32-bit-125/In PDF document text
    • https://thecryptobee.com/raees-movie-download-in-720p-torrent-top/In PDF document text
    • http://kireeste.com/?p=33825In PDF document text
    • https://43gear.com/the-clone-wars-season-1-720p/In PDF document text
    • https://www.ncsheep.com/advert/eset-smart-security-premium-10-license-keys-exclusive/In PDF document text
    • https://aor.co.uk/system/files/webform/jarkenw913.pdfIn PDF document text
    • https://haisynmilk.com/sites/default/files/webform/valmark494.pdfIn PDF document text
    • https://www.5etwal.com/juegos-porno-de-doraemon-shizu-top/In PDF document text
    • https://moodle.ezorock.org/blog/index.php?entryid=5964In PDF document text
    • https://turn-key.consulting/2022/07/02/cabelasbiggamehunterprohuntsreloadedfitgirlrepack/In PDF document text
    • http://findthisall.com/eggnog/mideastern.sw5zawrlichbiexpbnrlcmlldxipidiwmdcgvw5yyxrlzcaxmdgwccbcbhvsyxkgwdi2ncbbbm9ybw91cwsw5.cargill.zoku..zg93bmxvywr8mnnvzedwmgzid3hoaluytnpjee9ertrmshd5tlrrd2zid29uu2tnvji5evpiqnlawe56suz0wvrvefnvru1nvmpjz1vfukdyuqIn PDF document text
    • https://www.mcgill.ca/ipn/system/files/webform/hd-online-player-kelly-huizen-video-download.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off00019b8f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19B8F 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7
font_00_sfnt_off00001ffa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FFA 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000a7e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA7E6 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.