PDF static analysis report

Static analysis result for SHA-256 72b8f0c1f445e1d8…

SUSPICIOUS

PDF

116.0 KB Created: 2022-09-09 21:52:42 +00:00 Authoring application: virgrow (via PDF Master 1.0.1) First seen: 2026-06-28
MD5: 76dfa90d4a2eeafc4f293beb46680b08 SHA-1: acc704217b13a9727583b5527a8a96070773ef88 SHA-256: 72b8f0c1f445e1d824515d589b670fdecffbc4cb72a88ccda04412d4fd9b13da
42 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 4

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://godsearchs.com/armorer/?ZG93bmxvYWQga2Vvbmcgcm9zZSBvbmxpbmUgYm90ZG9=cyberlots&deemphasizes=/mountain/ZG93bmxvYWR8cm85WkdRd1ozeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/holdouts PDF link annotation
    • http://vietditru.org/advert/koutsoyiannis-modern-microeconomics-pdf-free-148-best/In PDF document text
    • http://stroiportal05.ru/advert/guitar-rig-5-serial-number-generator/In PDF document text
    • https://thebestmale.com/abb-docwin-3-0-verified/In PDF document text
    • https://alumbramkt.com/wp-content/uploads/2022/09/Xforce_Keygen_AutoCAD_Architecture_2007_64_Bit_Free_Downloadexe_HOT.pdfIn PDF document text
    • http://connect.tg/wp-content/uploads/2022/09/Cadence_Allegro_Extracta_Exe_CRACKED_Download.pdfIn PDF document text
    • https://idenjewelry.com/wp-content/uploads/Yahoo_Hacker_Pro_V289_Keyrar_HOT-1.pdfIn PDF document text
    • https://www.beaches-lakesides.com/realestate/hdd-regenerator-1-51-full-__hot__-cracked-hdd-bad-sector-remover/In PDF document text
    • https://farmaciacortesi.it/pdanet-apk-mod-unlock-all/In PDF document text
    • http://wp2-wimeta.de/eagle2018crack-crackedfileonly32bit/In PDF document text
    • https://heidylu.com/qpst-emmc-software-download-new-open-the-tool/In PDF document text
    • https://unoticket.com/wp-content/uploads/2022/09/ohimarc.pdfIn PDF document text
    • https://expressionpersonelle.com/gad-kille-maharashtra-pdf-patched-free/In PDF document text
    • http://www.giffa.ru/product-reviewsconsumer-electronics/cadence-orcad-166-crack-best-torrent/In PDF document text
    • http://instafede.com/?p=260551In PDF document text
    • http://thetruckerbook.com/2022/09/09/shaurya-720p-download-movies-top/In PDF document text
    • https://aboe.vet.br/advert/helpndoc-professional-crack-verified/In PDF document text
    • https://energypost.eu/wp-content/uploads/2022/09/Beyond_Flesh_And_Blood_Ativador_Download_HOT_Ativador.pdfIn PDF document text
    • https://thehomeofheroes.org/ddr-pen-drive-recovery-5412-best-crack/In PDF document text
    • https://arlingtonliquorpackagestore.com/smac20registrationidexclusive-keygengenerator/In PDF document text
    • http://mysquare.in/?p=In PDF document text
    • https://alumbramkt.com/wp-content/uploads/2022/09/Xforce_Keygen_AutoCAD_Architecture_2007_64In PDF document text
    • http://connect.tg/wp-In PDF document text
    • https://www.beaches-lakesides.com/realestate/hdd-regenerator-1-51-full-__hot__-cracked-hdd-bad-In PDF document text
    • https://energypost.eu/wp-In PDF document text
    • http://connect.tg/wp-content/uploads/2022/09/cadence_allegro_extracta_exe_cracked_download.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001e76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E76 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000a662.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA662 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.