Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f2d84a343e9e848…

MALICIOUS

PDF

33.4 KB Created: 2022-12-17 15:48:02 +00:00 Authoring application: kylwile (via mPDF 8.1.2) First seen: 2026-05-26
MD5: 66d306ee688960037aa0ad0834b8e483 SHA-1: 028e17db55c4f647e0454c035c574ed1ea122ad3 SHA-256: 2f2d84a343e9e8488e6ea5bad3a302a03eeb847991357dcc004340a8ceba4343
74 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0028

Heuristics 4

  • Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
    PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seachtop.com/brainskills.TXV0aHUgQ29taWNzIEZyZWUgUGRmIERvd25sb2FkTXV/downsides.evaluated/ZG93bmxvYWR8SUM3TVhSMGJIeDhNVFkzTVRJMk5qRTVOM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/lysozyme/deboarded/medals PDF link annotation
    • https://theairfryerstore.com/2022/12/17/arkaos-grandvj-xt-v203-pc-cracked-22-high-quality/In PDF document text
    • http://applebe.ru/?p=124296In PDF document text
    • https://soepinaobasta.com/wp-content/uploads/2022/12/Car-Setup-Guide-Rfactor-Crack-BEST.pdfIn PDF document text
    • https://reviewcouncil.in/wp-content/uploads/2022/12/Easeus-Data-Recovery-Wizard-Crack-Version-Free-Download-NEW.pdfIn PDF document text
    • https://www.onmoda.net/wp-content/uploads/2022/12/vanorasm.pdfIn PDF document text
    • https://reviewcouncil.in/wp-content/uploads/2022/12/Easeus-Data-Recovery-Wizard-Crack-Version-FrIn PDF document text
    • https://reviewcouncil.in/wp-content/uploads/2022/12/easeus-data-recovery-wizard-crack-version-free-download-new.pdfIn PDF document text
    • http://seachtop.com/brainskills.txv0ahugq29tawnziezyzwugugrmiervd25sb2fktxv/downsides.evaluated/zg93bmxvywr8sum3tvhsmgjiedhnvfkztvrjmk5qrtvom3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/lysozyme/deboarded/medalsIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_004_off00001ff8.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_004_off00001ff8.bin)
🗂 Part of campaign: dubaipropertyrentals.net 262 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00001ff8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1FF8 19780 bytes
SHA-256: 4fa1e1f62893db1504b694ba157ca733dbc9a64fe6775bec7c5c9e8d41f3a745
font_01_sfnt_off000053ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x53AB 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8

Open this report in the interactive analyzer, or submit your own file for analysis.