Malicious PDF — malware analysis report

Static analysis result for SHA-256 36aa48a39bba65a3…

MALICIOUS

PDF

123.3 KB Created: 2022-07-02 20:20:46 +00:00 Authoring application: biasha (via PDF Master 1.0.1) First seen: 2026-05-17
MD5: 231704ffb92715f867110c07bc42e3df SHA-1: 0a596c81a65cf2e7f09789e2d8a1754d6e5b2700 SHA-256: 36aa48a39bba65a34033339d292a72c2fc119ac788f636276f266f54bf99a2cc
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestsmartfind.com/acknowledges.martyr?camphor=&terraserver=farmers&QmlyZHNvbmcgU2ViYXN0aWFuIEZhdWxrcyBQZGYgRnJlZSBEb3dubG9hZAQml=larvicides&ZG93bmxvYWR8UWk4T1RabGQzeDhNVFkxTmpjM01UZ3hPSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA=physiologist PDF link annotation
    • https://www.lion.tech/wp-content/uploads/2022/07/Iron_Will_O_Grande_Desafio_Iron_Will1994DubladoPtBr17.pdfIn PDF document text
    • https://sttropezrestaurant.com/tomtomcarminateuropaupd-downloadchecked/In PDF document text
    • https://www.cameraitacina.com/en/system/files/webform/feedback/safval456.pdfIn PDF document text
    • http://richard-wagner-werkstatt.com/?p=60979In PDF document text
    • https://testthiswebsite123.com/2022/07/02/cities-skylines-modern-city-center-update-v1-12-3-f2-codex-new/In PDF document text
    • https://giessener-daemmstoffe.de/wp-content/uploads/2022/07/daremar.pdfIn PDF document text
    • https://www.slas.lk/advert/hd-online-player-download-rise-of-the-guardians-full-verified/In PDF document text
    • https://dev.izyflex.com/advert/sigershaders-v-ray-material-presets-pro-for-3ds-max-2016-serial-number/In PDF document text
    • http://adomemorial.com/2022/07/02/aquaveo-sms-11-2-crack-11-exclusive/In PDF document text
    • http://reddenegocios.garantizamifuturo.com/upload/files/2022/07/Ql3wyawO47xUWULmVPUO_02_e0e5e159d14c92f7b30e449cf0197a36_file.pdfIn PDF document text
    • https://gardeners-market.co.uk/advert/call-of-duty-black-ops-2-redacted-pc-game-exclusive/In PDF document text
    • https://thecryptowars.com/american-truck-simulator-v1-6-1-9s-incl-dlc-hack-online-install-2/In PDF document text
    • https://kramart.com/toorpu-ramayanam-free-download-mp3-work/In PDF document text
    • https://tagnigeria.com/kdv-rbv-pjk-boys-zip/In PDF document text
    • http://myquicksnapshot.com/?p=17496In PDF document text
    • https://www.greatescapesdirect.com/wp-content/uploads/2022/07/Modernization_Of_Indian_Tradition_By_Yogendra_Singh_Pdf_22.pdfIn PDF document text
    • http://mysteriesoftheunknown.com/wp-content/uploads/2022/07/maeda_atsuko_photo_book_free_download.pdfIn PDF document text
    • https://germanconcept.com/wp-content/uploads/2022/07/Reallifecam_Forum_REPACK.pdfIn PDF document text
    • https://demo.takewp.com/listing/tpg-explore/advert/revolver-2005-dual-audio-hindi-english/In PDF document text
    • http://patsprose.com/PatriciaBenagesBooks/ArtlclesIn PDF document text
    • http://bestsmartfind.com/acknowledges.martyr?camphor=&terraserver=farmers&qmlyzhnvbmcgu2viyxn0awfuiezhdwxrcybqzgygrnjlzsbeb3dubg9hzaqml=larvicides&zg93bmxvywr8uwk4t1rabgqzedhnvfkxtmpjm01uz3hpshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda=physiologistIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003f2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F2A 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000c716.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC716 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261