Malicious PDF — malware analysis report

Static analysis result for SHA-256 6eb5a79f0f237d51…

MALICIOUS

PDF

96.8 KB Created: 2022-06-09 20:21:54 +02:00 Authoring application: bilnesb (via PDF Master 1.0.1) First seen: 2026-05-25
MD5: 085aaee17bbb3b00c47422b0bcd6a710 SHA-1: bb5dfe96bbc407169756645ec3e1ff9ba353bdf5 SHA-256: 6eb5a79f0f237d5186d1feb2a8d27b3a72be6c1d1c027dace0361e5eb2a1b649
174 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0046

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF links to document on public blob storage high PDF_PUBLIC_BLOB_DOCUMENT_LINK
    PDF contains a clickable action to a document payload hosted on public blob/object storage. Shared object storage can be used legitimately, so this rule is suspicious rather than conclusive unless paired with lure text or other phishing indicators.
  • Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
    PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/RGVzY2FyZ2FyIFBsYW5pbGxhIERlIFBhZ28gRGVsIFNlbmlhdCBEcG4gMjURGV/cornflakes.novelist.ZG93bmxvYWR8bDd3WVhNNFozeDhNVFkxTkRjNE1EYzROM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA?aggressions=rollie&rtanswers=tandoori PDF link annotation
    • http://exponor.mercurioantofagasta.cl/advert/3d-optical-mouse-rating-5v-100ma-driver-download-portable/In PDF document text
    • https://startclube.net/upload/files/2022/06/FFkxCDhfXDRAXuQZPasm_09_9ebbb4be8783c9737b3ee0bedf53b239_file.pdfIn PDF document text
    • https://eleve-efb.fr/wp-content/uploads/2022/06/Halo_4_Passwordtxt.pdfIn PDF document text
    • http://www.zebrachester.com/lumion-3-32-bit-torrent-angels-melinda-villa/In PDF document text
    • https://storage.googleapis.com/faceorkut.com/upload/files/2022/06/Pmz2uD5oto2bNdC5ZJhC_09_9ebbb4be8783c9737b3ee0bedf53b239_file.pdfIn PDF document text
    • https://thenationalreporterng.com/ontrack-easyrecovery-professional-technician-v12-0-0-2-dc-better-keygen/In PDF document text
    • https://www.inscriu.ro/wp-content/uploads/2022/06/Catzilla_4K__Advanced_Full_Crack_crack.pdfIn PDF document text
    • https://pi-psy.org/wp-content/uploads/2022/06/natflo.pdfIn PDF document text
    • https://dailyjaguar.com/wp-content/uploads/2022/06/Download_Driver_Modem_Usb_Huawei_E173_TOP.pdfIn PDF document text
    • https://gowestshore.com/wp-content/uploads/descargarenciclopediaencarta2009gratisparawindows7.pdfIn PDF document text
    • https://www.yapidurealestate.com/windows-7-ab-april-2019-wird-ein-������sha-2-update����-benotigt-free/In PDF document text
    • https://croatiansincleveland.com/wp-content/uploads/2022/06/fritam.pdfIn PDF document text
    • https://pteridoportal.org/portal/checklists/checklist.php?clid=12638In PDF document text
    • https://bramshawbv.com/?p=40225In PDF document text
    • http://ampwebsitedesigner.com/wp-content/uploads/2022/06/writphy.pdfIn PDF document text
    • https://p2p-tv.com/wp-content/uploads/2022/06/Metasploit_License_Key_Crack.pdfIn PDF document text
    • https://tarpnation.net/x-force-keygen-autocad-lt-2016-64-bit-free-download/In PDF document text
    • https://webtium.com/wp-content/uploads/2022/06/Nuendo_5_Usb_Elicenser_Crack_Serial_Torrent_Download.pdfIn PDF document text
    • https://meuconhecimentomeutesouro.com/adan-zye-php-pdf-indir/In PDF document text
    • http://evacdir.com/rgvzy2fyz2fyifbsyw5pbgxhierlifbhz28grgvsifnlbmlhdcbecg4gmjurgv/cornflakes.novelist.zg93bmxvywr8bdd3wvhnnfozedhnvfkxtkrjne1eyzrom3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda?aggressions=rollie&rtanswers=tandooriIn PDF document text
    • https://serv.biokic.asu.edu/paleo/portal/checklists/checklist.php?clid=4859In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: shared payload 4d76c2b8d2 5 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00001271.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1271 120748 bytes
SHA-256: 4d76c2b8d2ed9222de382323e6eae624da6c33f61dca8bd7f892ff4b34bebdc2
stream_007_off00010477.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x10477 119072 bytes
SHA-256: df221e87b81d1531cafdadb6c09a602e9f604d1baf0a17bbd350cbb83baa06f7