Malicious PDF — malware analysis report

Static analysis result for SHA-256 19112f2aa9eb2022…

MALICIOUS

PDF

128.3 KB Created: 2022-09-11 13:48:30 +00:00 Authoring application: dashjam (via PDF Master 1.0.1) First seen: 2026-06-22
MD5: 257c4bd91e385a4fcec8e764f7e7a498 SHA-1: b69b0e5a033046a41259e0aae8055195165ecb25 SHA-256: 19112f2aa9eb2022175c59f2e2d012287d8ab8c86e5c916ad8c3db2ee7f2f249
122 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestentrypoint.com/ergonomically/arteriole=closer/UmViZWwgSW5jOiBFc2NhbGF0aW9uIFBDIEdhbWUgRnJlZSBEb3dubG9hZAUmV=incandescence/midgley.ZG93bmxvYWR8dnI2ZVRZNU1YeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA PDF link annotation
    • http://www.hacibektasdernegi.com/wp-content/uploads/cadtools_8_2_mac_serial_crack.pdfIn PDF document text
    • http://www.giffa.ru/who/company-of-heroes-mega-trainer-2-700-relaunch/In PDF document text
    • https://antiquesanddecor.org/bejeweled-3-2021-full-version-download/In PDF document text
    • https://soflodetox.com/wp-content/uploads/2022/09/Figure_Study_Made_Easy_By_Aditya_Chari_Pdf_360_Fix.pdfIn PDF document text
    • https://www.skiptracingleads.com/wp-content/uploads/2022/09/Panzer_Corps_2_Free_Download_Extra_Quality_Crack_Cocaine.pdfIn PDF document text
    • https://agedandchildren.org/raptisoft-hamsterball-gold-v2-16r-zip-crack-free-__full__/In PDF document text
    • https://armslengthlegal.com/wp-content/uploads/2022/09/download_miracle_box_setup_cracked_16.pdfIn PDF document text
    • http://shaeasyaccounting.com/gerenciamento-da-rotina-do-trabalho-do-dia-a-dia-falconi-pdf-downloadl-2021/In PDF document text
    • https://www.dominionphone.com/titanium-portable-timekeeper-software-epub-high-quality/In PDF document text
    • http://moonreaderman.com/aegisub-karaoke-effect-30-full/In PDF document text
    • https://superyacht.me/advert/bangla-book-tazkiratul-awliya-pdf-rapidshare-top/In PDF document text
    • https://vizforyou.com/wp-content/uploads/2022/09/sasdelc.pdfIn PDF document text
    • https://www.batiksukses.com/environmental-psychology-5th-edition-bell-pdf-reader/In PDF document text
    • https://earthoceanandairtravel.com/wp-content/uploads/2022/09/Prepar3D_V4_Professional_Plus_402321468_Key_Generator.pdfIn PDF document text
    • https://techadarsh.com/wp-content/uploads/2022/09/AUTODATA_845_Crack_FULL_crack.pdfIn PDF document text
    • https://bodhibliss.org/link-downloadnavionegps/In PDF document text
    • https://materiaselezioni.com/wp-content/uploads/2022/09/hilphe.pdfIn PDF document text
    • https://www.verenigingvalouwe.nl/advert/chibi-maruko-chan-episodes-in-hindi-download-portable/In PDF document text
    • http://www.giffa.ru/who/download-__exclusive__-superbad-unrated-2007-720p-brrip-x264-700mb-yify-torrent-kickasstorrents/In PDF document text
    • https://savebyzipcode.com/wp-content/uploads/2022/09/walaesm.pdfIn PDF document text
    • https://soflodetox.com/wp-In PDF document text
    • https://www.skiptracingleads.com/wp-In PDF document text
    • https://armslengthlegal.com/wp-In PDF document text
    • http://shaeasyaccounting.com/gerenciamento-da-rotina-do-trabalho-do-dia-a-dia-falconi-pdf-In PDF document text
    • https://earthoceanandairtravel.com/wp-In PDF document text
    • http://www.giffa.ru/who/download-__exclusive__-superbad-unrated-2007-720p-brrip-x264-700mb-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.