Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a1700de92817c28…

MALICIOUS

PDF

123.9 KB Created: 2022-06-13 00:28:57 +02:00 Authoring application: markar (via PDF Master 1.0.1) First seen: 2026-05-31
MD5: 3559635fa297101b1b1f36e467e04ab4 SHA-1: a120d790e976dd4990936419da6c456df7c33fe2 SHA-256: 5a1700de92817c28662bccaa5b938330235bbf8cc4a21a1cbe724da818f58561
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/agawa/VGVub3JzaGFyZSBSZWlCb290IFBybyA3LjMuNS4xMiBDcmFjawVGV/spic.anker?ZG93bmxvYWR8Vk05ZERBM2JueDhNVFkxTkRrNE9URTJNbng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/integument/lowlights== PDF link annotation
    • https://novinmoshavere.com/wp-content/uploads/2022/06/nerjany.pdfIn PDF document text
    • http://barrillos.org/2022/06/12/libro-el-verdadero-pablo-sangre-traicion-y-muerte-pdf-top/In PDF document text
    • https://sissycrush.com/upload/files/2022/06/QewWvM8U8zDLxAey18p9_12_1e2a8a2042fa02560beb45ee3f68110b_file.pdfIn PDF document text
    • https://sahabhaav.com/rodobus-simulator-full-tek-link-indir/In PDF document text
    • https://www.voyavel.it/activation-code-for-euro-truck-simulator-1-3/In PDF document text
    • https://www.indianhomecook.com/wp-content/uploads/2022/06/gilbkhry.pdfIn PDF document text
    • http://armina.bio/?p=23284In PDF document text
    • https://eafuerteventura.com/reimage-pc-repair-2020-license-key-crack-full-version-free-download-__top__/In PDF document text
    • https://bbv-web1.de/wirfuerboh_brett/advert/fondamenti-di-fisica-halliday-sesta-edizione-pdf/In PDF document text
    • https://dawatgaran.com/advert/ezprox-contactless-reader-driver-new-download/In PDF document text
    • https://thoitranghalo.com/2022/06/12/adilia-horse-belly-riding/In PDF document text
    • https://www.zonearticles.com/advert/pokemon-emerald-egglocke-sav-file-13/In PDF document text
    • https://chatinzone.com/upload/files/2022/06/XIMzTT7vwPSUEm395FXr_12_a54a652d9e841375e96196ec4889a633_file.pdfIn PDF document text
    • http://malenatango.ru/terjemah-kitab-mujarobat-ad-dairoby-pdfl/In PDF document text
    • http://naasfilms.com/wp-content/uploads/AdGuard_733026_Crack_License_Key_Download_2020.pdfIn PDF document text
    • https://www.travelmindsets.com/active-hard-disk-monitor-pro-3-1-9-full-version-rar-hintergrunde-sonntag-mickey-visio/In PDF document text
    • https://svistok.org/wp-content/uploads/2022/06/molelatr.pdfIn PDF document text
    • https://medcoi.com/network/upload/files/2022/06/X7fcFPxJyaklewQQtSDx_12_763144fb962964cc5c5507c666e8ec2b_file.pdfIn PDF document text
    • http://www.medvedy.cz/fajront-u-sarajevu-pdf-download/In PDF document text
    • https://morda.eu/upload/files/2022/06/xIUd5AclJEbukSLAtyxa_12_a54a652d9e841375e96196ec4889a633_file.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00000f1a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xF1A 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000bcfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBCFD 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.