PDF static analysis report

Static analysis result for SHA-256 72b48f51d8cb284f…

SUSPICIOUS

PDF

250.5 KB Created: 2022-07-19 01:07:48 +00:00 Authoring application: phyrurit (via PDF Master 1.0.1) First seen: 2026-06-29
MD5: 10ba60ef0ab77a2e52ab17ddbf6d19ea SHA-1: 18a063d54db5b92f2661c6c98362d7fa36a473db SHA-256: 72b48f51d8cb284f3d28fe3385f285eac3e266cd2d54a6ec798e207a8507fbdf
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://esecuritys.com/infantry/ZG93bmxvYWR8WnM1TVRWbGFXVjhmREUyTlRnd01EWTJPVGw4ZkRJMU9UQjhmQ2hOS1NCWGIzSmtjSEpsYzNNZ1cxaE5URkpRUXlCV01pQlFSRVpk&deactivated/donauinsel/kennsington/gurhan/ZmFybWluZyBzaW11bGF0b3IgMjAwOSBwcm9kdWN0IGFjdGl2YXRpb24ga2V5LjMzZmF.hossa PDF link annotation
    • https://endleleni.com/digital-system-design-by-anand-kumar-34-epub/In PDF document text
    • https://farmasetika.com/wp-content/uploads/2022/07/Bosch_Kts_200_Start_Center_Crack_Extra_Qualityed.pdfIn PDF document text
    • http://armina.bio/?p=56231In PDF document text
    • https://jobdahanday.com/total-video-converter-3-12-full-cracked-free-download-link/In PDF document text
    • https://www.webcard.irish/ab-bulk-mailer-with-keyl/In PDF document text
    • http://festivaldelamor.org/?p=5062792In PDF document text
    • https://donorpartie.com/wp-content/uploads/2022/07/certus_pro_crack.pdfIn PDF document text
    • https://silkfromvietnam.com/top-spin-3-pc-patched-download-torent-tpb/In PDF document text
    • https://www.scoutgambia.org/downloadfilmsipitungfull-portable/In PDF document text
    • http://www.lynnlevinephotography.com/?p=12440In PDF document text
    • https://ubipharma.pt/2022/07/19/hardata-dinesat-radio-8-crack-hot/In PDF document text
    • https://knowconhecimento.com/najbogatiji-covek-vavilona-pdf-40-best/In PDF document text
    • https://villamaremonti.com/wp-content/uploads/2022/07/ullrkry.pdfIn PDF document text
    • https://ipa-softwareentwicklung.de/wp-content/uploads/2022/07/Eset_Nod32_Astuce_Pour_Trouver_Des_Licences_A_VIE__161l.pdfIn PDF document text
    • http://www.chandabags.com/miopocket-40-release-68zip-work/In PDF document text
    • http://barrillos.org/2022/07/19/ghidul-culegatorului-de-ciuperci-pdf-download-work/In PDF document text
    • https://songgiatri.com/image/verdbets.pdfIn PDF document text
    • https://koenigthailand.com/wp-content/uploads/2022/07/facebook_hacker_v18rar_12_17_mb.pdfIn PDF document text
    • http://lalinea100x100.com/?p=58793In PDF document text
    • http://orakprecast.net/39150.htmlIn PDF document text
    • https://farmasetika.com/wp-In PDF document text
    • https://ipa-softwareentwicklung.de/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c52.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C52 84704 bytes
SHA-256: 864a9502ff763264058b169e2f00c6f0dd176c0d5dc944c52e73ce99f4852e3f
font_01_sfnt_off0000b493.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB493 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261