Malicious PDF — malware analysis report

Static analysis result for SHA-256 212b8c455ddb2c95…

MALICIOUS

PDF

127.7 KB Created: 2022-06-22 10:05:28 +02:00 Authoring application: paerhea (via PDF Master 1.0.1) First seen: 2026-06-02
MD5: 284dedc6e9b828a113178445fc94b85d SHA-1: 55acbde6c784ad55831d8c3eacaa02d62daaa0e1 SHA-256: 212b8c455ddb2c950224b9ce00b297883afb6c806cb5dc5b9cf6d77296fc7786
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/beguiling.RG93bmxvYWQgRGVzZW5lIENhcnRlYSBKdW5nbGVpIEluIFJvbWFuYQRG9/caramelizes/corduroy/ZG93bmxvYWR8dFk1WW1nM2IzeDhNVFkxTlRnME1qazRNWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/vertigo=dialling PDF link annotation
    • https://rebon.com.co/lenovo-a7000-a-blu-lcd-fix-flash-file-firmware-mt6752-__full__/In PDF document text
    • https://jimmyvermeulen.be/wp-content/uploads/2022/06/berbrod.pdfIn PDF document text
    • https://dawnintheworld.net/swansoft-cnc-simulator-7-1-12-best/In PDF document text
    • https://www.periodicoelapogeo.com.ar/site/advert/southwest-savings-loans-personal-loan-quotes/In PDF document text
    • http://stealthilyhealthy.com/?p=6686In PDF document text
    • https://www.ibjf.at/wp-content/uploads/2022/06/PTC_ENGINEER_WILDFIRE_V5_0.pdfIn PDF document text
    • https://www.oic.it/sites/default/files/webform/geomagic-design-x-2016-crack-14.pdfIn PDF document text
    • https://www.filmwritten.org/?p=13045In PDF document text
    • http://galaxy7music.com/?p=42330In PDF document text
    • http://rackingpro.com/?p=20590In PDF document text
    • http://pussyhub.net/airbus-a320-cbt-64-bitl-exclusive/In PDF document text
    • https://dogrywka.pl/sniper-ghost-warrior-2-msvcr100-dll-is-missing-in-games/In PDF document text
    • https://www.tuslibros.cl/wp-content/uploads/2022/06/colgawa.pdfIn PDF document text
    • https://pneuscar-raposo.com/drivers-for-pcline-pcl100k-webcam-setup-free-best/In PDF document text
    • https://conbluetooth.net/terjemahan-syarah-umdatul-ahkam-pdf-download-extra-quality/In PDF document text
    • https://battlefinity.com/upload/files/2022/06/ej7G2fpMa5d8N9EkeROl_22_ae63daeecd2cc897033d1b3d633acef9_file.pdfIn PDF document text
    • https://tinilist.com/wp-content/uploads/2022/06/Architectural_Thesis_On_Bus_Terminal.pdfIn PDF document text
    • https://towntexas.com/wp-content/uploads/2022/06/call_of_duty_modern_warfare_2_highly_compressed_only_37_mb_m.pdfIn PDF document text
    • http://iptvpascher.com/?p=20695In PDF document text
    • https://optimizetf.com/wp-content/uploads/2022/06/Open_Mind_Level_1_Student_Book_Pdf.pdfIn PDF document text
    • https://battlefinity.com/upload/files/2022/06/ej7G2fpMa5d8N9EkeROl_22_ae63daeecd2cc897033d1b3d633acef9_file.pIn PDF document text
    • https://towntexas.com/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_007_off000029de.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x29DE 120304 bytes
SHA-256: aba0c2ff9d87ae688eda9486e6cf744f07397b5d5eb3f9357ff8fb324baec1ec
font_01_sfnt_off0000d809.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD809 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.