Malicious PDF — malware analysis report

Static analysis result for SHA-256 4af79e4b031c73df…

MALICIOUS

PDF

133.2 KB Created: 2022-07-25 08:45:27 +00:00 Authoring application: gardar (via PDF Master 1.0.1) First seen: 2026-06-05
MD5: 13ccf2ba94288d1693e238f180f55a60 SHA-1: 9b5a08bcabcc3997c0438f243a08a7cbcbf29c00 SHA-256: 4af79e4b031c73dfd5e27e49526cd56ab9488a7d3ab377f0c05f73dca6ad5c6a
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mydrugdir.com/augenstein/computerize?QW51cmFnIFBybyAxMCBGdWxsIFZlcnNpb24gQ3JhY2sgNjAQW5=ZG93bmxvYWR8aEwyWW1wcGVueDhNVFkxT0RJeE9EazROWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/suave.flashcard&kindergartners=remodified PDF link annotation
    • https://beautyprosnearme.com/sinhala-lama-kathandara-pdf-56/In PDF document text
    • https://dailyjaguar.com/wp-content/uploads/2022/07/Itprotv_Vs_Cbt_Nuggets_Download_.pdfIn PDF document text
    • https://learnpace.com/crack-new-in-the-world-resource-pack/In PDF document text
    • http://www.giffa.ru/who/portable-norton-ghost-v15-0-eng-exclusive/In PDF document text
    • https://www.scoutgambia.org/rocket-valley-tycoon-full-hot-crack-hack/In PDF document text
    • https://www.newportcyclespeedway.co.uk/advert/security-monitor-pro-5-1-keygen-generator-best/In PDF document text
    • https://muslimprofessionalsgh.org/advert/english-vocabulary-in-use-upper-intermediate-2nd-edition-pdf-download-verified/In PDF document text
    • http://www.cocinarconmilagros.com/wp-content/uploads/2022/07/ignzant.pdfIn PDF document text
    • https://sumakart.com/adeko-9-305l-305-351-kodu-better/In PDF document text
    • http://www.caribbeanequipmenttraders.com/wp-content/uploads/2022/07/Download_Simda_Versi_21_FULL.pdfIn PDF document text
    • https://zip-favor.ru/wp-content/uploads/2022/07/Download_UPD_Spryt55_Hack.pdfIn PDF document text
    • https://in-loving-memory.online/corel-videostudio-pro-x2-v12-0-98-0-fixed-full-rar/In PDF document text
    • https://nadaindus.com/shyama-sundara-kera-kedara-bhoomi-mp3-songs-free-downloading-full/In PDF document text
    • https://unsk186.ru/ultra-video-splitter-with-__link__-keygen-__link__-keygen-9193/In PDF document text
    • https://thoitranghalo.com/wp-content/uploads/2022/07/eplan_electric_p8_2_4_keygen_11.pdfIn PDF document text
    • https://consultation-allaitement-maternel.be/wp-content/uploads/2022/07/halgen.pdfIn PDF document text
    • https://kramart.com/inmunologia-de-janeway-pdf-descargar-free-exclusive/In PDF document text
    • http://shop.chatredanesh.ir/?p=80817In PDF document text
    • https://expertiniworldtech.com/wp-content/uploads/2022/07/Space_Simulator_Mobile_Download_For_Pc_crack_BESTl.pdfIn PDF document text
    • https://eqsport.biz/wp-content/uploads/2022/07/coofaus.pdfIn PDF document text
    • https://muslimprofessionalsgh.org/advert/english-vocabulary-in-use-upper-intermediate-2nd-edition-In PDF document text
    • http://www.caribbeanequipmenttraders.com/wp-In PDF document text
    • https://expertiniworldtech.com/wp-In PDF document text
    • https://expertiniworldtech.com/wp-content/uploads/2022/07/space_simulator_mobile_download_for_pc_crack_bestl.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: caribbeanequipmenttraders.com 4 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_011_off0001a174.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A174 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7
font_00_sfnt_off00002625.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2625 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000ae11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE11 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.