Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a9e7d6931655c8f…

MALICIOUS

PDF

142.7 KB Created: 2022-07-18 21:59:56 +00:00 Authoring application: lynglyn (via PDF Master 1.0.1) First seen: 2026-06-29
MD5: 7faf434620286d3b066f33fe5d982d7b SHA-1: 14505624dde55344a33531ec951dd8aac70b3596 SHA-256: 4a9e7d6931655c8fc1f055eb4e24409cbc0cfeded4f1c5b2659ea9bc102210b4
134 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0005

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://awarefinance.com/absenteeism/strongholds/ZG93bmxvYWR8WnQwTVRKM1puVjhmREUyTlRnd01EWTJPVGw4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk?fuzzier=shelved.c2V0b29sIGJveCAzIGNyYWNrLnJhcgc2V.streaks.triathlon.greated PDF link annotation
    • https://kurtiniadis.net/wp-content/uploads/2022/07/nithcass-1.pdfIn PDF document text
    • http://adomemorial.com/2022/07/18/download-fxpansion-bfd2-full-version-fixed/In PDF document text
    • https://coolbreezebeverages.com/libro-conceptos-basicos-de-quimica-sherman-pdfl-exclusive/In PDF document text
    • http://galaxy7music.com/?p=61273In PDF document text
    • http://epochbazar.com/wp-content/uploads/2022/07/raidred.pdfIn PDF document text
    • https://www.asv-ventabren.fr/wp-content/uploads/2022/07/Beena_Antony_Malayalam_Serial_Actress_Blue_Film_BEST.pdfIn PDF document text
    • https://wormenhotel.nl/wp-content/uploads/2022/07/bryan_adams_discography_torrent_free_download.pdfIn PDF document text
    • https://dd-school.com/wp-content/uploads/2022/07/molhav.pdfIn PDF document text
    • https://innovacioncosmetica.com/eggcrack-2-0-minecraft-account-hacker-free-download-patched/In PDF document text
    • https://www.batiksukses.com/anno-1404-crack-updated-for-windows-7-rar/In PDF document text
    • https://www.bigdawgusa.com/so-wirds-gemacht-golf-4-pdf-download-verified/In PDF document text
    • https://khakaidee.com/hdenvironmentsetup-exe-free/In PDF document text
    • http://www.ndvadvisers.com/maithuna-rahas-2-pdf-top/In PDF document text
    • http://www.rathisteelindustries.com/greendot-moneypak-activation-code-generator-v1-3-install/In PDF document text
    • https://acheinoaraguaia.com/wp-content/uploads/2022/07/mythware_classroom_management_crack_cocaine.pdfIn PDF document text
    • https://slitetitle.com/autocad-2014-software-free-download-full-version-with-crack-link-2/In PDF document text
    • https://koshmo.com/wp-content/uploads/2022/07/dataarn.pdfIn PDF document text
    • http://www.hva-concept.com/fabfilter-pro-c-2-cracked-hot/In PDF document text
    • https://www.rentbd.net/pyaar-ishq-aur-mohabbat-1-2-3-720p-in-dual-audio-hindi-hot/In PDF document text
    • https://www.shankari.net/2022/07/18/free-download-recovery-password-plc-fatek-rar-exclusive/In PDF document text
    • https://www.asv-ventabren.fr/wp-In PDF document text
    • https://wormenhotel.nl/wp-In PDF document text
    • https://acheinoaraguaia.com/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fe8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FE8 84532 bytes
SHA-256: ed0cdf4bba35f3c873575bdb9685980ba8a745a3e05f0d31cdd1457f1503eff9
font_01_sfnt_off0000b7e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB7E6 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.