Malicious PDF — malware analysis report

Static analysis result for SHA-256 6249baa82ec72c68…

MALICIOUS

PDF

112.0 KB Created: 2022-09-12 22:07:27 +00:00 Authoring application: perrhart (via PDF Master 1.0.1) First seen: 2026-05-29
MD5: 289b8664f7a513642e71dc7ac95503dc SHA-1: 84b4de5b064028e3a6c06a16c483bbe76e41bd79 SHA-256: 6249baa82ec72c68ac2a2f631b375bfe7905b8ea88cefb117b4b4d489393017b
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0017

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://signforcover.com/absorbed/wrecking/coolers.ZG93bmxvYWR8ZTNjTVdaa2FHcDhmREUyTmpJMk9EQXpPVEI4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk/snouts/TG92ZUFhakthbDJmdWxsbW92aWVkb3dubG9hZGhkNzIwcATG9.juicers/ PDF link annotation
    • https://www.fashionservicenetwork.com/wp-content/uploads/2022/09/vjdirector2_ultimate_edition_crack_serial.pdfIn PDF document text
    • https://www.hemppetlover.com/wp-content/uploads/2022/09/kelsam.pdfIn PDF document text
    • https://mindspa-india.com/wp-content/uploads/2022/09/Super_Deep_Throat_Mod_Loader_5_V1151b_TOP.pdfIn PDF document text
    • https://www.chiesacristiana.eu/2022/09/13/the-witcher-2-enhanced-edition-crack-3-4-top/In PDF document text
    • http://nii-migs.ru/?p=22053In PDF document text
    • https://discovery.info/taylormadeclips-breast-expansion/In PDF document text
    • https://www.reptisell.com/solucionario-welty-fundamentos-de-transferencia-de-momento-calor-y-masa-22/In PDF document text
    • https://laculinaria.de/scorpions-acoustica-2001-flac-japan-1st-press-14-updated/In PDF document text
    • https://afribizkid.africa/wp-content/uploads/2022/09/glynhay.pdfIn PDF document text
    • https://lynonline.com/2022/09/12/eagleget-2-1-6-20-portable-top/In PDF document text
    • http://www.diarioelsoldecusco.com/advert/king-solomon-and-his-followers-texas-edition-translatedzip-_best_/In PDF document text
    • http://yotop.ru/2022/09/13/hd-online-player-prototype-highly-compressed-20-mb-fo-2021/In PDF document text
    • https://teenmemorywall.com/michael-w-ford-bible-of-the-adversary-pdf-24-full/In PDF document text
    • http://dichvuhoicuoi.com/birdman-in-hindi-dubbed-movie-download-full/In PDF document text
    • https://www.buriramguru.com/wp-content/uploads/2022/09/Mcd001ps2_WWE_Smackdown__Here_Comes_The_Pain_PCSX2_Memory_Card_File_For_PlayStation_2_SAVE.pdfIn PDF document text
    • https://itsakerhetsbolaget.se/wp-content/uploads/2022/09/jamimog.pdfIn PDF document text
    • https://keephush.net/wp-content/uploads/2022/09/berjai.pdfIn PDF document text
    • https://italytourexperience.com/wp-content/uploads/2022/09/lenrad.pdfIn PDF document text
    • https://kedaigifts.com/wp-content/uploads/2022/09/Rich_Dad_Poor_Dad_Pdf_Free_Download_LINK_In_Marathi_Rava_Ahnentafel_Autorennen_Bewerbungsf.pdfIn PDF document text
    • https://www.thebangladeshikitchen.com/wp-content/uploads/2022/09/Windows_7_With_SP1__AIO__Hebrew_Download_Pc.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012c4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C4 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009ab0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9AB0 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261