Malicious PDF — malware analysis report

Static analysis result for SHA-256 191f8d177fa96907…

MALICIOUS

PDF

138.9 KB Created: 2022-07-03 10:26:20 +00:00 Authoring application: ellefald (via PDF Master 1.0.1) First seen: 2026-06-22
MD5: 2235b0a7bd88c49cc54812a808a42f32 SHA-1: a9851692c79afedeef816565328ff4caf5707f9e SHA-256: 191f8d177fa96907a426d91d60c9fb2d395ef26929acec401069d2980cd70514
134 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestentrypoint.com/aesthetical/leathery.borderlines?boasters.ladot.ZG93bmxvYWR8dVEwY1dFMWJIeDhNVFkxTmpjM01UZ3hPSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA=skis&tiptoes=TUVHQSBTQU1QTEVTIFZPTC0xMDITUV PDF link annotation
    • http://www.ndvadvisers.com/desktop-icon-toy-4-5-serial-number-free-download-exclusive/In PDF document text
    • https://thecryptobee.com/wp-content/uploads/2022/07/eirphi.pdfIn PDF document text
    • https://gforce.dev/wp-content/uploads/2022/07/diasan.pdfIn PDF document text
    • https://www.hony.nl/online-casino/crack-patched-dameware-remote-support-9-0-ex-dameware-nt-utilities/In PDF document text
    • https://plainbusiness.net/anydesk-extra-quality-crack-2020/In PDF document text
    • https://smartpolisforums.com/wp-content/uploads/2022/07/frontaly.pdfIn PDF document text
    • http://diversityforum.net/wp-content/uploads/2022/07/ArcPad_10_Torrent_HOT_Full_Version.pdfIn PDF document text
    • https://hissme.com/upload/files/2022/07/iw51r5UJmrxAYdYYXyEf_03_e60e7dcfcc6191fe1e3abbe35515ed06_file.pdfIn PDF document text
    • https://youtubemap.net/wp-content/uploads/2022/07/Mystery_Case_Files_Huntsville_Crack_Download_LINK.pdfIn PDF document text
    • https://www.apbara.be/index.php/advert/igo-primo-for-800x480-windows-ce-6-0-62-repack/In PDF document text
    • http://www.flexcompany.com.br/flexbook/upload/files/2022/07/OR4m7DuEVpM7YZv3Gjb7_03_e60e7dcfcc6191fe1e3abbe35515ed06_file.pdfIn PDF document text
    • https://www.5etwal.com/wp-content/uploads/2022/07/Skyrim_1932_Update_Download_LINK.pdfIn PDF document text
    • https://www.melag.com/es/system/files/webform/careclave/pelhmora116.pdfIn PDF document text
    • https://colonialrpc.com/advert/activator-for-windows-and-office-kms-pico-v11-2-3-serial-key-keygen-fix/In PDF document text
    • https://vdsproductions.nl/hd-online-player-jab-we-met-movies-hindi-free-downloa-updated/In PDF document text
    • https://storage.googleapis.com/faceorkut.com/upload/files/2022/07/vm3J3x1aK2wk4rmJVSyj_03_e60e7dcfcc6191fe1e3abbe35515ed06_file.pdfIn PDF document text
    • http://www.travelmindsets.com/?p=14914In PDF document text
    • https://lacasagroups.com/wp-content/uploads/2022/07/gerebert.pdfIn PDF document text
    • http://diversityforum.net/wp-content/uploads/2022/07/arcpad_10_torrent_hot_full_version.pdfIn PDF document text
    • https://www.law.gwu.edu/system/files/webform/Jaane-Tu-Ya-Jaane-Na-Movie-Download-In-Torrent.pdfIn PDF document text
    • https://www.vevioz.com/upload/files/2022/07/LJK6rBxUq6MYztgBMRNZ_03_e60e7dcfcc6191fe1e3abbe35515ed06_file.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.