Malicious PDF — malware analysis report

Static analysis result for SHA-256 116dcf90cbf64086…

MALICIOUS

PDF

123.1 KB Created: 2022-06-12 06:47:34 +02:00 Authoring application: fulamo (via PDF Master 1.0.1) First seen: 2026-06-05
MD5: ccb5f968262ebf78f617648ed2422e11 SHA-1: f188edd945f52727fb3751d0faf475f1979d63e3 SHA-256: 116dcf90cbf640867aaeca5676a88cd1ce6273e92f132eef0ae729bb148cd792
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0018

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/trichophyton/bassa/bartender/UmVhc29uIDEwLjUgQ3JhY2sgRnVsbCBJbnN0YWxsIERPV05MT0FEIFdpbm1hY09TIE1hY09TWAUmV/graecia/ZG93bmxvYWR8SVg2WVdGMmJIeDhNVFkxTkRrNE9URTJNbng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.lunatic PDF link annotation
    • https://ifkgoteborgorientering.se/advert/a-beautiful-mind-hindi-dubbed-mobile-558/In PDF document text
    • http://hotelthequeen.it/2022/06/12/believing-is-seeing-mary-anne-staniszewski-pdf-downloadgolkes/In PDF document text
    • https://aacitta.com/wp-content/uploads/2022/06/Download_One_Karaoke_Full_Version.pdfIn PDF document text
    • https://omidsoltani.ir/wp-content/uploads/2022/06/grayal.pdfIn PDF document text
    • https://oknit.ru/wp-content/uploads/2022/06/Scrubs_Complete_Collection_Seasons_19_MKV_X264__YIFY.pdfIn PDF document text
    • https://thebakersavenue.com/map-cs-extreme-v7/In PDF document text
    • https://mycoopmed.net/nidhogg-online-multiplayer-crack-for-19-top/In PDF document text
    • https://gretchenscannon.com/wp-content/uploads/2022/06/Fotos_De_Danielle_Colby_Desnuda.pdfIn PDF document text
    • https://reputation1.com/headway-academic-skills-level-1-pdf-download-work/In PDF document text
    • https://xn--80aagyardii6h.xn--p1ai/filme-somos-todos-diferentes-dublado/In PDF document text
    • https://efekt-metal.pl/witaj-swiecie/In PDF document text
    • https://wildlifekart.com/wp-content/uploads/2022/06/Stock_It_Easy_7_Crack.pdfIn PDF document text
    • https://techadarsh.com/wp-content/uploads/2022/06/EVGA_Nvidia_Geforce_Driver_Installation_CD_Ver_09210501__Setup_Freel.pdfIn PDF document text
    • https://texvasa.com/wp-content/uploads/2022/06/derlawr.pdfIn PDF document text
    • http://www.ossmediterraneo.com/?p=7880In PDF document text
    • https://homeoenergy.com/wp-content/uploads/2022/06/giaflo.pdfIn PDF document text
    • http://facebook.jkard.com/upload/files/2022/06/17CMYkhl2531oVHWf7vr_12_27aaf13e7bdaa84f4ef1abc90c09f4f8_file.pdfIn PDF document text
    • http://www.ecelticseo.com/initial-d-extreme-stage-pc-game-download/In PDF document text
    • https://shapshare.com/upload/files/2022/06/pwnTicpgxjswQhWlahbt_12_27aaf13e7bdaa84f4ef1abc90c09f4f8_file.pdfIn PDF document text
    • https://serv.biokic.asu.edu/paleo/portal/checklists/checklist.php?clid=8361In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00000c76.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xC76 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000ba59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBA59 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54