Malicious PDF — malware analysis report

Static analysis result for SHA-256 4459b0c4c0583b5b…

MALICIOUS

PDF

114.3 KB Created: 2022-09-10 20:23:39 +00:00 Authoring application: nichxeen (via PDF Master 1.0.1) First seen: 2026-06-12
MD5: 2161a172c74e1a553b05640561f04bd8 SHA-1: 436dc3f8592546b612443089e7aa05f2f9a06c27 SHA-256: 4459b0c4c0583b5be36674012c51e5b62af0cf3190d13bbee054f72e1c9ec398
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which advertise cracked software, indicating a lure to malicious sites. One of the external URIs, http://esecuritys.com/assxw/, is likely a landing page for malware or further phishing attempts. No scripts were extracted from this sample, but the PDF structure itself is used to host a link farm.

Machine Learning

  • Nyx PDF Classifier clean score 0.0016

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://esecuritys.com/assxw/?dalda.atex=U2FsZWVtIDIwMDkgVGVsdWd1IE1vdmllIERUSFJpcCBYMjY0dG9ycmVudAU2F&lambs=matteo&ZG93bmxvYWR8bnU0Y0Roc2JueDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA=multipoint PDF link annotation
    • https://lpkekselenpalembang.com/wp-content/uploads/2022/09/quynik.pdfIn PDF document text
    • https://breakingnewsandreligion.online/wp-content/uploads/2022/09/yalyov.pdfIn PDF document text
    • https://yukoleather.net/wp-content/uploads/2022/09/cecirand.pdfIn PDF document text
    • https://www.rutaecologica.com/wp-content/uploads/2022/09/talenark.pdfIn PDF document text
    • http://www.gualandimeccanica.it/wp-content/uploads/2022/09/jaequi-1.pdfIn PDF document text
    • http://sourceofhealth.net/2022/09/10/nx-os-emulator-titanium-5-12-vmware-image/In PDF document text
    • https://cgservicesrl.it/wp-content/uploads/2022/09/wooambr.pdfIn PDF document text
    • https://www.chiesacristiana.eu/2022/09/10/hyperspace-v1-4-incl-patched-and-keygen-win-osx-r2r-exclusive/In PDF document text
    • https://alafdaljo.com/houdini-4-pro-w32-cbf-extra-quality-free-download/In PDF document text
    • http://awaazsachki.com/?p=72408In PDF document text
    • https://kcmuslims.com/advert/last-xp-v17-2-2-for-alex-de-la-focsani/In PDF document text
    • https://thecluelesscoffee.com/wp-content/uploads/2022/09/modern_control_engineering_ogata_5th_edition_solution_manual.pdfIn PDF document text
    • http://steamworksedmonton.com/descargar-igo-primo-24-iberia-win-ce-60-better/In PDF document text
    • http://fiskenaesbaadlaug.dk/?p=16571In PDF document text
    • https://teetch.co/wp-content/uploads/2022/09/Cimpack_13_1_Crack_Erodes.pdfIn PDF document text
    • https://www.markeritalia.com/2022/09/10/uvi-workstation-2-0-9-vst-32-bit/In PDF document text
    • https://www.webcard.irish/digital-playground-premium-creator-v2-4/In PDF document text
    • https://teenmemorywall.com/manual-da-mesa-de-som-arcano-em-portugues-free/In PDF document text
    • https://atompublishing.info/free-download-updated-hum-hai-raahi-car-ke-hindi/In PDF document text
    • https://madridvirtual.net/recovery-toolbox-excel-top-crack/In PDF document text
    • https://www.chiesacristiana.eu/2022/09/10/hyperspace-v1-4-incl-patched-and-keygen-win-osx-r2r-In PDF document text
    • https://thecluelesscoffee.com/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.