Malicious PDF — malware analysis report

Static analysis result for SHA-256 43cc517badf39d99…

MALICIOUS

PDF

23.8 KB Created: 2023-01-20 01:03:26 +01:00 Authoring application: 376377000l000a000n000d000w000i000l000e (via GPL Ghostscript 9.55.0) First seen: 2026-04-13
MD5: 1955d8f8845ada73a255ce41e4501fc2 SHA-1: 3b4e9f9df4451729a81727596f42e1e602f03e7e SHA-256: 43cc517badf39d9957543674f7ce4ef66d12fad9f6f6eba111693044733b2784
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0361

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://urllio.com/2sEvzg PDF link annotation
    • https://xn--80aagyardii6h.xn--p1ai/bluestacks-0-6-2-0563a-portable-2/In PDF document text
    • https://boucanier.ca/wp-content/uploads/2023/01/werolata.pdfIn PDF document text
    • https://viajacomolocal.com/wp-content/uploads/2023/01/gavrroz.pdfIn PDF document text
    • https://seecurrents.com/wp-content/uploads/2023/01/delpchin.pdfIn PDF document text
    • https://sweetangels.in/wp-content/uploads/2023/01/Lakshya-Movie-Download-High-Quality-In-Hindi-1080p.pdfIn PDF document text
    • https://contabeissemsegredos.com/karvalo-kannada-novel-pdf-download-hot/In PDF document text
    • https://dealstoheal.com/?p=78207In PDF document text
    • https://www.candipipes.com/wp-content/uploads/2023/01/kaflhar.pdfIn PDF document text
    • https://rei-pa.com/wp-content/uploads/2023/01/DowntonAbbeyS01Season1COMPLETEBDRipXviDHAGGiS.pdfIn PDF document text
    • https://www.forper.fr/blog/inferno-movie-download-mp4-hd/In PDF document text
    • https://worldbookingadvisor.com/wp-content/uploads/2023/01/docvyan-1.pdfIn PDF document text
    • https://asalidigitals.com/wp-content/uploads/2023/01/Watch-Boyss-Toh-Boyss-Hain-The-Movie-Full-LINK-Version-Online-Free.pdfIn PDF document text
    • https://mercatinosport.com/wp-content/uploads/2023/01/janakei.pdfIn PDF document text
    • https://hirupmotekar.com/wp-content/uploads/shauoli.pdfIn PDF document text
    • https://umbo-avis.fr/wp-content/uploads/2023/01/piervucm.pdfIn PDF document text
    • https://parsiangroup.ca/2023/01/microsoft-visual-basic-v6-0-professional-utorrent-upd/In PDF document text
    • http://www.alwaysflorida.com/?p=1In PDF document text
    • https://mentorus.pl/http-uploadsnack-c-om-nmtkm7-password-torrent-1-better/In PDF document text
    • https://www.abcintr.com/wp-content/uploads/2023/01/Hd_Hindi_Video_Songs_720p_Mkv_Free_19.pdfIn PDF document text
    • https://sweetangels.in/wp-content/uploads/2023/01/Lakshya-Movie-Download-High-Quality-In-Hindi-In PDF document text
    • https://rei-pa.com/wp-content/uploads/2023/01/DowntonAbbeyS01Season1COMPLETEBDRipXviDHAIn PDF document text
    • https://asalidigitals.com/wp-content/uploads/2023/01/Watch-Boyss-Toh-Boyss-Hain-The-Movie-Full-LIIn PDF document text
    • https://www.abcintr.com/wp-content/uploads/2023/01/Hd_Hindi_Video_Songs_720p_Mkv_Free_19.pdIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C55 4908 bytes
SHA-256: 5970aae21ba2e102b1a6b2b5819fae4070912b1d6d708133d2af131666ec54ce
font_01_sfnt_off00003ab8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AB8 8952 bytes
SHA-256: d9b34524a8db9f4054c475f8387db8ca4820993b88dc1b378d3425a6e75c97d0