PDF static analysis report

Static analysis result for SHA-256 2b6af67261cdddcf…

SUSPICIOUS

PDF

131.7 KB Created: 2022-09-09 11:55:24 +00:00 Authoring application: ottyvur (via PDF Master 1.0.1) First seen: 2026-06-17
MD5: 18ecfbc25cebe0b7c70b0701ed367168 SHA-1: ecab20b57d0728496784ed3316065aebc0d5b5f1 SHA-256: 2b6af67261cdddcf1a497637864c6b49a8b925ed4c2b825648663e50de542f7d
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blogbasters.com/amplitude/togas.cassaundra.endoscopist/ZG93bmxvYWR8YWs3TjJ0ak0zeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/recourse/thinkgermany.thronging.U2Ftc3VuZyBUb29scyBWMiAxLjAgNyBId2sgQnkgU2FyYXNzb2Z0IE1lZ2EgcGVsaXMgcGlhbm8gY3ViaXggZW4U2F PDF link annotation
    • http://www.prokaivos.fi/wp-content/uploads/uleelvy.pdfIn PDF document text
    • https://cambodiaonlinemarket.com/descargar-crack-hot-no-cd-motocross-madness-2/In PDF document text
    • http://tara-info.ru/wp-content/uploads/2022/-/osmooles-1.pdfIn PDF document text
    • http://yotop.ru/2022/09/09/icecream-screen-recorder-pro-5-21-crack-download-best/In PDF document text
    • https://www.flyerbee.com/greys-anatomy-season-3-download-link-kickass/In PDF document text
    • https://cleverposse.com/advert/money-robot-submitter-new-crack-135/In PDF document text
    • https://shrouded-beyond-05102.herokuapp.com/pevcere.pdfIn PDF document text
    • https://abckidsclub.pl/macrium-reflect-7-top-crack/In PDF document text
    • https://expressionpersonelle.com/new-colin-mcrae-dirt-2-_verified_-crack/In PDF document text
    • https://socks-dicarlo.com/wp-content/uploads/2022/09/vanchipattu_lyrics_malayalam_pdf_download.pdfIn PDF document text
    • https://www.antreprenoare.ro/wp-content/uploads/2022/09/musiche_tirolesi_da_scaricare.pdfIn PDF document text
    • https://aqueous-ocean-06728.herokuapp.com/Pro_Tools_1282_Crack_Activation_Code_Win_Mac_Kickass_Downloa.pdfIn PDF document text
    • https://earthoceanandairtravel.com/wp-content/uploads/2022/09/ersklate.pdfIn PDF document text
    • https://bodhirajabs.com/wp-content/uploads/2022/09/Kitchendraw_45_Crack_Free_Download_EXCLUSIVE.pdfIn PDF document text
    • https://quiet-dusk-02974.herokuapp.com/PATCHED_Sony_Picture_Package_v181.pdfIn PDF document text
    • https://liquidonetransfer.com/wp-content/uploads/2022/09/To_Mscz_Converterpdf_LINK.pdfIn PDF document text
    • https://obscure-meadow-58486.herokuapp.com/winflasher_3121exe_for_windows_7.pdfIn PDF document text
    • https://www.iltossicoindipendente.it/2022/09/09/the-crims-bot-travian-bot-12/In PDF document text
    • https://prendimisubito.com/wp-content/uploads/2022/09/giovjes.pdfIn PDF document text
    • https://pnda-rdc.com/hd-online-player-chhota-bheem-and-the-throne-of-bali-top/In PDF document text
    • https://socks-dicarlo.com/wp-In PDF document text
    • https://aqueous-ocean-06728.herokuapp.com/Pro_Tools_1282_Crack_Activation_Code_Win_Mac_KickIn PDF document text
    • https://bodhirajabs.com/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off00019b27.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19B27 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7