Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b48cda5439d7786…

MALICIOUS

PDF

127.4 KB Created: 2022-06-09 05:59:02 +02:00 Authoring application: joyffor (via PDF Master 1.0.1) First seen: 2026-05-16
MD5: 7e4caca48f37e05b2c1fe47111f5a5a8 SHA-1: e6e25c1aa2600ae2b6251a8670ec917107d2d714 SHA-256: 1b48cda5439d77860731517a6a11e88886a15252d74d5ea8b0fc0711d503078a
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0019

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/ferrysburg/sauber/beguinage/lisle/QW1lcmljYSdzIEFybXk6IFByb3ZpbmcgR3JvdW5kcyBjcmFjayBhbGwgdHlwZSBoYWNrcwQW1.ZG93bmxvYWR8bnIxT0RKNGQzeDhNVFkxTkRjek1EZzRObng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA..preview PDF link annotation
    • http://launchimp.com/mafiagameforpcisox3gamehackpassword-link/In PDF document text
    • https://elektrobest.de/wp-content/uploads/2022/06/Smartphone_Tycoon_116_Mod_Apk.pdfIn PDF document text
    • https://www.puremeditation.org/wp-content/uploads/gv_650_800_s_v3_51.pdfIn PDF document text
    • http://el-com.org/wp-content/uploads/2022/06/Undelete_Plus_EXCLUSIVE_Crack_Serial_Keygen.pdfIn PDF document text
    • https://poetbook.com/upload/files/2022/06/Po3rpkqIjmeZc6P8T8hH_09_a41e8dffd0d879419861737dc6393b6a_file.pdfIn PDF document text
    • https://www.centerlb.org/wp-content/uploads/2022/06/qenetala.pdfIn PDF document text
    • https://ihunt.social/upload/files/2022/06/MnHlxdVWw2Uvi7Tu8WGF_09_a41e8dffd0d879419861737dc6393b6a_file.pdfIn PDF document text
    • https://lms.kincatonly.com/blog/index.php?entryid=9043In PDF document text
    • https://sebastianarnezeder.com/wp-content/uploads/2022/06/Vidio_Sex_Wanita_Vs_Kuda.pdfIn PDF document text
    • https://ukrainefinanceplatform.com/wp-content/uploads/2022/06/rawlravi.pdfIn PDF document text
    • http://slimancity.com/upload/files/2022/06/cxZ6adL3J1WfYMlkmW2W_09_16936c08224d7e2c0e071f35017fbaac_file.pdfIn PDF document text
    • http://www.divinejoyyoga.com/wp-content/uploads/2022/06/warrgers.pdfIn PDF document text
    • https://www.laundryandcleaningtoday.co.uk/advert/call-of-duty-wwii-pc-game-nosteamro-download-pc/In PDF document text
    • https://feimes.com/explaindio-video-creator-4-0-14-crack-free-incl-torrent/In PDF document text
    • https://www.donemil.com/wp-content/uploads/2022/06/Wondershare_drfone_201_license_key.pdfIn PDF document text
    • http://www.perfectlifestyle.info/saguni-tamil-full-movie-hd-1080p/In PDF document text
    • https://oregonflora.org/checklists/checklist.php?clid=20572In PDF document text
    • https://poetbook.com/upload/files/2022/06/Po3rpkqIjmeZc6P8T8hH_09_a41e8dffd0d879419861737dc6393b6a_fIn PDF document text
    • https://ihunt.social/upload/files/2022/06/MnHlxdVWw2Uvi7Tu8WGF_09_a41e8dffd0d879419861737dc6393b6a_In PDF document text
    • http://slimancity.com/upload/files/2022/06/cxZ6adL3J1WfYMlkmW2W_09_16936c08224d7e2c0e071f35017fbaaIn PDF document text
    • http://evacdir.com/ferrysburg/sauber/beguinage/lisle/qw1lcmljysdziefybxk6ifbyb3zpbmcgr3jvdw5kcybjcmfjaybhbgwgdhlwzsboywnrcwqw1.zg93bmxvywr8bnixt0rkngqzedhnvfkxtkrjek1ezzrobng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda..previewIn PDF document text
    • https://serv.biokic.asu.edu/ecdysis/checklists/checklist.php?clid=6055In PDF document text
    • https://secureservercdn.net/160.153.138.177/ozq.d77.myftpupload.com/wp-content/uploads/2022/06/mammar.pdf?time=1654746844In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://secureservercdn.net/160.153.138.177/ozq.d77.myftpupload.com/wp-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00001510.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1510 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000c2f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2F3 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.