Malicious PDF — malware analysis report

Static analysis result for SHA-256 6df22eaca688cab4…

MALICIOUS

PDF

114.6 KB Created: 2022-09-09 02:21:55 +00:00 Authoring application: golger (via PDF Master 1.0.1) First seen: 2026-05-19
MD5: 487497fa12f6a49db8ae9728044c6942 SHA-1: 8b549c187b9130e71fdc64019674811fc828158b SHA-256: 6df22eaca688cab462a6f16c07c9a53dbd4d7bb88e58c6250c24e9fb2182f128
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sitesworlds.com/allergen/forslean/Q2FwdGFpbiBGb3JldmVyIFJlbWl4IEZyZWUgRG93bmxvYWQgY3JhY2sgY29jYWluZQQ2F/?seatwork=ZG93bmxvYWR8RGw1TVdobmIzeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA&heroines=.instill PDF link annotation
    • https://cryptic-anchorage-39536.herokuapp.com/gta4_ps2_iso_highly_compressed.pdfIn PDF document text
    • https://arteshantalnails.com/2022/09/09/tarzan-1999-1080p-brrip-x264-1-2gb-yify-free/In PDF document text
    • https://www.luckyanimals.it/adobe-acrobat-3d-version-8-serial-number-best/In PDF document text
    • http://nuihoney.com/yamashita-treasure-signs-and-symbols-pdf-download-new/In PDF document text
    • http://villa-mette.com/?p=75982In PDF document text
    • https://mohacsihasznos.hu/advert/bootit-v1-07-epub/In PDF document text
    • https://kedaigifts.com/wp-content/uploads/2022/09/Adobe_Illustrator_10_Ce_Serial_Number.pdfIn PDF document text
    • https://estatezone.net/wp-content/uploads/2022/09/iCloud_Bypass_with_iPhone_XR.pdfIn PDF document text
    • http://www.drbonesonline.com/?p=36057In PDF document text
    • https://sarahebott.org/plagiarism-detection-software-crack-download-new/In PDF document text
    • https://pacific-chamber-89113.herokuapp.com/fenalee.pdfIn PDF document text
    • https://cryptic-beyond-54719.herokuapp.com/NeoDownloader_v303_Build_208.pdfIn PDF document text
    • https://efekt-metal.pl/witaj-swiecie/In PDF document text
    • https://www.hotels-valdys.fr/computershardware/setool2lite-v1-11-epub-linkIn PDF document text
    • https://iscs-conference.com/ht2000-motherboard-manual-pdf-free-fix/In PDF document text
    • http://it-labx.ru/?p=140250In PDF document text
    • https://gentle-hamlet-55673.herokuapp.com/Auto_Data_3_38_2012_Srpski_Jezikepub.pdfIn PDF document text
    • http://topfleamarket.com/?p=78747In PDF document text
    • https://irabotee.com/wp-content/uploads/2022/09/Livro_Portugues_Linguagens_9_Ano_Download_Pdf_WORK.pdfIn PDF document text
    • https://levitra-gg.com/?p=61947In PDF document text
    • https://cryptic-In PDF document text
    • https://arteshantalnails.com/2022/09/09/tarzan-1999-1080p-brrip-x264-1-2gb-yify-In PDF document text
    • https://kedaigifts.com/wp-In PDF document text
    • https://estatezone.net/wp-In PDF document text
    • https://irabotee.com/wp-content/uploads/2022/09/Livro_Portugues_Linguagens_9_AnIn PDF document text
    • http://sitesworlds.com/allergen/forslean/q2fwdgfpbibgb3jldmvyifjlbwl4iezyzwugrg93bmxvywqgy3jhy2sgy29jywluzqq2f/?seatwork=zg93bmxvywr8rgw1tvdobmizedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda&heroines=.instillIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: efekt-metal.pl 339 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16F9 84836 bytes
SHA-256: aa9a698f08c48a5f4534095f844be2c005242a1382ef74d2874e3e33c181dd1f
font_01_sfnt_off00009f9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F9E 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261