PDF static analysis report

Static analysis result for SHA-256 72b9325b44f4c66b…

SUSPICIOUS

PDF

116.6 KB Created: 2022-09-10 08:17:37 +00:00 Authoring application: ormvay (via PDF Master 1.0.1) First seen: 2026-06-28
MD5: 3f61719659ca8a6c726adb9b7d555473 SHA-1: 9002d04ff0f3620d28468ae3f71cdc85de5ae819 SHA-256: 72b9325b44f4c66b27b832186b47322c25063ef48c4e71f3ea9e0926a84ca3c9
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0009

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lehmanbrotherbankruptcy.com/geographical/race&ZnJlZSBkb3dubG9hZCBjYWtld2FsayBwcm8gYXVkaW8gOSBmdWxsIHZlcnNpb24ZnJ/marvelously&ZG93bmxvYWR8S2ExYVhkclozeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/quadra.leage PDF link annotation
    • https://ikcasino.com/2022/09/10/collision-cb-fighting-read/In PDF document text
    • http://quitoscana.it/2022/09/10/jazler-radiostar-264-full-top/In PDF document text
    • http://aiplgurugram.com/?p=44119In PDF document text
    • https://generalskills.org/%fr%In PDF document text
    • https://gembeltraveller.com/pantoner-f-h-cotton-tcx-hit-link/In PDF document text
    • https://teenmemorywall.com/streets-of-rage-remake-5-1-15-best-mods-hack-pc/In PDF document text
    • https://aboe.vet.br/advert/xforce-keygen-32bits-or-64bits-version-autocad-2009-download-new/In PDF document text
    • https://www.newportcyclespeedway.co.uk/advert/deep-free-linkze-standard-7000203172-serial-76/In PDF document text
    • https://cambodiaonlinemarket.com/melhor-site-para-hackear-facebook-gratis-__link__/In PDF document text
    • http://naturopathworld.com/?p=14152In PDF document text
    • https://feimes.com/evermotion-archmodels-vol-63-torrent-full/In PDF document text
    • https://ayoikut.com/advert/hd-online-player-sonic-the-hedgehog-full-movie-hindi-top/In PDF document text
    • https://endlessorchard.com/advanced-design-system-2013-06-crack-extra-quality/In PDF document text
    • http://toxtronyx.com/?p=12169In PDF document text
    • https://ccazanzibar.com/wp-content/uploads/2022/09/HD_Online_Player_Pink_Panther_2_Movie_In_Hindi_3gp_Fr_TOP.pdfIn PDF document text
    • https://freecricprediction.com/wp-content/uploads/2022/09/Architecte_3DHD_Expert_Cad_2010_NEW_Crack_Pack.pdfIn PDF document text
    • https://ak-asyl-mgh.de/advert/a-ferfiak-a-marsrol-a-nok-a-venuszrol-jottek-pdf-download-work/In PDF document text
    • https://namiflorist.com/lotus-one-shot-kit-wav-exclusive/In PDF document text
    • https://frotastore.com/wp-content/uploads/2022/09/godofwarascensionpspiso.pdfIn PDF document text
    • https://ccazanzibar.com/wp-In PDF document text
    • https://freecricprediction.com/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002277.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2277 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000aa63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAA63 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261