Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e3283acb83272f4…

MALICIOUS

PDF

127.3 KB Created: 2022-06-10 07:12:58 +02:00 Authoring application: gitefad (via PDF Master 1.0.1) First seen: 2026-06-19
MD5: b294948aec5b585a0d908a4aa2fdfcd5 SHA-1: 914bba6a51e75a6917f58f44ed64c2c495be00ed SHA-256: 4e3283acb83272f428c413740667b1c3c19b5f739608df422054d88f55a2ab14
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0011

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/ZnJlZWRvd25sb2FkZmlmYXN0cmVldDRmdWxsdmVyc2lvbmdhbWVmb3JwY3JhcgZnJ/nichd/amounted?&chassagne=drunkenness&sphygmomanometer=edged&flippin=ZG93bmxvYWR8eTM3WVdkMGVIeDhNVFkxTkRjNE1EZzNPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA PDF link annotation
    • https://bunkerbook.de/upload/files/2022/06/LiGtItD8m7fpqpVf1rYc_10_b325f40cccf3ce729fdbb036474331b3_file.pdfIn PDF document text
    • https://mercatoposto.com/wp-content/uploads/2022/06/panorag.pdfIn PDF document text
    • https://telebook.app/upload/files/2022/06/iNPDUDfpbBRhl68eRoJE_10_bf76948c2337a84596811ed6dba4f2a5_file.pdfIn PDF document text
    • https://soroherbaria.org/portal/checklists/checklist.php?clid=90411In PDF document text
    • https://parshamgamenergy.com/wp-content/uploads/2022/06/evalmec.pdfIn PDF document text
    • https://volektravel.com/wp-content/uploads/2022/06/Sasur_Bari_Zindabad_Full_Movie_Download.pdfIn PDF document text
    • https://ulsterlinen.com/wp-content/uploads/2022/06/Descargar_Libro_Pensativa_Pdf_Download.pdfIn PDF document text
    • https://arabwomeninfilms.media/wp-content/uploads/2022/06/Movavi_Video_Editor_1001_Serial_Key.pdfIn PDF document text
    • https://208whoisgreat.com/wp-content/uploads/2022/06/gittal.pdfIn PDF document text
    • https://suchanaonline.com/vehiculos-pro-v-6-10-better/In PDF document text
    • https://surprisemenow.com/egr-remover-keygen-download-updated/In PDF document text
    • https://43gear.com/4clipika-for-windows-7-18-full/In PDF document text
    • https://bodhirajabs.com/kitabsafinatunnajahpdf/In PDF document text
    • https://sharmilam.com/wp-content/uploads/2022/06/Need_For_Speed_2019_3dm_Crack_Downloadl.pdfIn PDF document text
    • https://www.pickupevent.com/fsx-aerosoft-mega-airport-budapest-v2-00-free-download/In PDF document text
    • https://www.realteqs.com/teqsplus/upload/files/2022/06/BXGylkKTX6NF8YjPQWsR_10_bf76948c2337a84596811ed6dba4f2a5_file.pdfIn PDF document text
    • https://oursocial.io/upload/files/2022/06/kiyyvIGbheBWfaWpembT_10_bf76948c2337a84596811ed6dba4f2a5_file.pdfIn PDF document text
    • https://blueridgealchemy.net/sap200-v14-full-crack/In PDF document text
    • http://iptvpascher.com/?p=6912In PDF document text
    • https://omorua.com/wp-content/uploads/2022/06/elladd.pdfIn PDF document text
    • https://www.realteqs.com/teqsplus/upload/files/2022/06/BXGylkKTX6NF8YjPQWsR_10_bf76948c2337a84596811ed6dba4f2In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00001ad9.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1AD9 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4

Open this report in the interactive analyzer, or submit your own file for analysis.