Malicious PDF — malware analysis report

Static analysis result for SHA-256 4789fb3a9fb00087…

MALICIOUS

PDF

144.9 KB Created: 2022-06-11 05:37:09 +02:00 Authoring application: reinredl (via PDF Master 1.0.1) First seen: 2026-06-20
MD5: 861931ec0f99ee4c79f4ae2963a3463c SHA-1: f358040b1caaa453c7e47f019f4afa64d0878a19 SHA-256: 4789fb3a9fb000874be9edc516acf3792bee893331aa58ce9a03a83f77eee18a
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0008

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/comedically.U2VyaWFsIERlIEFjdGl2YWNpb24gUGFyYSBEcml2ZXIgRWFzeSA0NSBUYXJpbmdhU2V?dmarkmobile=movie&ramirez=caracas&sidings=ZG93bmxvYWR8clY3WVd4cU5YeDhNVFkxTkRnNU16RTVNWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA& PDF link annotation
    • https://sokhanedoost.com/wp-content/uploads/2022/06/jandmeli.pdfIn PDF document text
    • http://escortguate.com/clickteamfusion25downloadcrack-updated/In PDF document text
    • https://www.voyavel.it/alcatech-bpm-studio-pro-4-91-h2o-serial-key-hot/In PDF document text
    • https://friendship.money/upload/files/2022/06/fY5dicZbFPhlg3zgpzCb_11_cb32c000091c874eb2748fad60a83f40_file.pdfIn PDF document text
    • http://stv.az/?p=2939In PDF document text
    • https://alumbramkt.com/truertalevel4keygen11-exclusive/In PDF document text
    • https://www.afaceripromo.ro/wp-content/uploads/2022/06/Nunarcdll_16.pdfIn PDF document text
    • https://dogrywka.pl/sony-vaio-windows-7-recovery-disk-torrent/In PDF document text
    • https://beta.pinoysg.net/upload/files/2022/06/PPR2SITNVFZFy8RJlbmE_11_dc34b82c38d91e35aaa5444b9bba99cf_file.pdfIn PDF document text
    • https://dragonsecho.com/wp-content/uploads/2022/06/egidacke.pdfIn PDF document text
    • https://vitinhlevan.com/luu-tru/9345In PDF document text
    • http://yogaapaia.it/archives/10087In PDF document text
    • https://indir.fun/wp-content/uploads/fridadol.pdfIn PDF document text
    • https://teleo.es/upload/files/2022/06/393MoreTVEXYayLr8WYT_11_dc34b82c38d91e35aaa5444b9bba99cf_file.pdfIn PDF document text
    • https://www.dejavekita.com/upload/files/2022/06/TyuwFzeT3MksRdmlkqsa_11_dc34b82c38d91e35aaa5444b9bba99cf_file.pdfIn PDF document text
    • https://orbeeari.com/solucionario-yu-takeuchi-ecuaciones-23/In PDF document text
    • http://moonreaderman.com/phoenix-bios-download-update-free/In PDF document text
    • https://rxharun.com/logixpro-v1-6-1-allen-bradley-plc-simulator-64-bit/In PDF document text
    • https://sarahebott.org/wp-content/uploads/2022/06/Star_Trek_Starship_Creator_Warp_2_Patch.pdfIn PDF document text
    • http://www.studiofratini.com/prison-break-season-1-2-3-4-complete-720p-bluray-x264-rar-rar/In PDF document text
    • https://friendship.money/upload/files/2022/06/fY5dicZbFPhlg3zgpzCb_11_cb32c0000In PDF document text
    • https://beta.pinoysg.net/upload/files/2022/06/PPR2SITNVFZFy8RJlbmE_11_dc34b82In PDF document text
    • https://teleo.es/upload/files/2022/06/393MoreTVEXYayLr8WYT_11_dc34b82c38d91In PDF document text
    • https://www.dejavekita.com/upload/files/2022/06/TyuwFzeT3MksRdmlkqsa_11_dc34In PDF document text
    • https://sarahebott.org/wp-In PDF document text
    • http://www.studiofratini.com/prison-break-season-1-2-3-4-complete-720p-bluray-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000011c5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11C5 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.