Malicious PDF — malware analysis report

Static analysis result for SHA-256 11663ae3e8fc0e5f…

MALICIOUS

PDF

144.1 KB Created: 2022-07-26 04:42:22 +00:00 Authoring application: darvall (via PDF Master 1.0.1) First seen: 2026-06-05
MD5: 8d8edbf717391f260c81ba1792a5e7f2 SHA-1: ab65307ecb1cc16ba1346db814c61dfe9a25b912 SHA-256: 11663ae3e8fc0e5fbdf60ae28530b3a9d68c55de2fddd2c65b773f62aa3aae3d
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dawnloadonline.com/crusade/fritata.fujifilm/ZG93bmxvYWR8eXYzZW10emNueDhNVFkxT0RJeE9EazROWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/?poems=/Q2llbCBHZXN0aW9uIENvbW1lcmNpYWxlIHYxOSAyMDEzQ2l/hkcr/dulloo/implementers PDF link annotation
    • https://htownkitchenandbath.com/2022/07/26/nflheadcoach09pchot-fulldownload/In PDF document text
    • https://sc-designgroup.com/wp-content/uploads/2022/07/mattharl.pdfIn PDF document text
    • https://www.beaches-lakesides.com/wp-content/uploads/2022/07/valiari.pdfIn PDF document text
    • https://juncty.com/wp-content/uploads/2022/07/Download_Bot_Nhac_Paltalk.pdfIn PDF document text
    • https://ebbsarrivals.com/2022/07/26/picture-instruments-image-2-lut-pro-1-0-14-hot-crack-mac-osx/In PDF document text
    • http://www.srandicky.sk/wp-content/uploads/2022/07/download_buku_ppdgj_iii_pdf.pdfIn PDF document text
    • https://4g89.com/house-flipper-garden-update-v1-18-codex-_verified_/In PDF document text
    • https://connectingner.com/2022/07/26/ifb-microwave-cookbook-by-nita-mehta/In PDF document text
    • http://www.chelancove.com/summitsoft-logo-design-studio-pro-vector-edition-2-0-1-5-crack-free/In PDF document text
    • http://ifurnit.ir/2022/07/26/ns1waveplugindownload-exclusivevst/In PDF document text
    • https://changehealthfit.cz/wp-content/uploads/2022/07/Counter_Strike_Global_Offensive_Indir_full_UPDATED.pdfIn PDF document text
    • https://www.iraya.ir/wp-content/uploads/2022/07/Lost_Season_4_English_Subtitles_720p.pdfIn PDF document text
    • http://babussalam.id/?p=30514In PDF document text
    • https://kramart.com/antrenmanlarla-geometri-1-cozumleri-indir-top/In PDF document text
    • https://www.rhodiusiran.com/wp-content/uploads/2022/07/wiktbre.pdfIn PDF document text
    • https://greenboxoffice.ro/wp-content/uploads/2022/07/Fizika_9_Fizikos_Vadovelis_9_Klaseipdf_HOT.pdfIn PDF document text
    • https://staging.sonicscoop.com/advert/download-__hot__-phoenix-rc-pro-simulator-v4-0-25/In PDF document text
    • https://4s71.com/mixmeister-fusion-7-7-serial/In PDF document text
    • https://volektravel.com/descargar-genexus-x-evolution-2-updated-full-18/In PDF document text
    • http://classibox.wpbranch.com/advert/apple-imac/In PDF document text
    • https://ebbsarrivals.com/2022/07/26/picture-instruments-image-2-lut-pro-1-0-14-hot-In PDF document text
    • http://www.srandicky.sk/wp-In PDF document text
    • http://www.chelancove.com/summitsoft-logo-design-studio-pro-vector-In PDF document text
    • https://changehealthfit.cz/wp-In PDF document text
    • https://www.iraya.ir/wp-In PDF document text
    • https://greenboxoffice.ro/wp-In PDF document text
    • https://staging.sonicscoop.com/advert/download-__hot__-phoenix-rc-pro-simulator-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000306e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x306E 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000b85a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB85A 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261