Malicious PDF — malware analysis report

Static analysis result for SHA-256 72bb6a78364ba268…

MALICIOUS

PDF

124.6 KB Created: 2022-07-05 07:13:57 +00:00 Authoring application: giosilyn (via PDF Master 1.0.1) First seen: 2026-06-28
MD5: bb349f1ba689119e906c7a228a6c3f59 SHA-1: bb9ff9f277bea090d57f782d1d03eaddd66fda31 SHA-256: 72bb6a78364ba268583f651f0ff479c6d0fc7e5a56bebecf4f6ee21fde4dd8c9
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0236

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://raisengine.com/QWRvYmUgUGhvdG9zaG9wIDIwMjIgKFZlcnNpb24gMjMuMikQWR.beguines/clomid/courbet/ZG93bmxvYWR8cUk0T1RnMWQzeDhNVFkxTmprNE1UVXdOSHg4TWpVNE4zeDhLRTBwSUVobGNtOXJkU0JiUm1GemRDQkhSVTVk/faith?clueless=merging PDF link annotation
    • https://damp-shore-43730.herokuapp.com/jamxyl.pdfIn PDF document text
    • https://tuscomprascondescuento.com/wp-content/uploads/2022/07/Adobe_Photoshop_CS5.pdfIn PDF document text
    • https://maple-backbacon-63159.herokuapp.com/mattsax.pdfIn PDF document text
    • https://clubsoccer360.com/wp-content/uploads/2022/07/grasjan.pdfIn PDF document text
    • https://ibaimoveis.com/wp-content/uploads/2022/07/Photoshop_CC_2015_version_16.pdfIn PDF document text
    • https://www.matera2029.it/wp-content/uploads/2022/07/Photoshop_2022_Version_2311_Product_Key__Download.pdfIn PDF document text
    • https://crystalshine.eu/wp-content/uploads/2022/07/webbnan.pdfIn PDF document text
    • https://520bhl.com/wp-content/uploads/2022/07/Photoshop_CC_2014_Hack_Patch___For_PC.pdfIn PDF document text
    • https://chaos-magick.com/wp-content/uploads/2022/07/Adobe_Photoshop_CS3_With_License_Key___Activator_WinMac_Latest_2022.pdfIn PDF document text
    • https://italytourexperience.com/wp-content/uploads/2022/07/Photoshop_CS3.pdfIn PDF document text
    • https://wakandaplace.com/wp-content/uploads/2022/07/elvynat.pdfIn PDF document text
    • https://dd-school.com/wp-content/uploads/2022/07/coremm.pdfIn PDF document text
    • https://www.spinergo.com/wp-content/uploads/2022/07/Photoshop_2021_Version_222_Free.pdfIn PDF document text
    • https://sfgym24h.com/wp-content/uploads/2022/07/Photoshop_2021_Version_223.pdfIn PDF document text
    • https://fathomless-plains-42290.herokuapp.com/Adobe_Photoshop_CC_2018_version_19.pdfIn PDF document text
    • https://harneys.blog/wp-content/uploads/2022/07/Adobe_Photoshop_2021_version_22_keygenexe___Keygen_Free.pdfIn PDF document text
    • https://blooming-sierra-09621.herokuapp.com/uzaydeev.pdfIn PDF document text
    • http://www.easytable.online/wp-content/uploads/2022/07/Photoshop_2021_HACK__License_Keygen.pdfIn PDF document text
    • https://media1.ambisonic.se/2022/07/Photoshop_2021_Version_2251_HACK_.pdfIn PDF document text
    • https://fagmann.no/wp-content/uploads/2022/07/Adobe_Photoshop_2021_Version_223.pdfIn PDF document text
    • https://safe-everglades-13145.herokuapp.com/lorber.pdfIn PDF document text
    • https://obscure-lowlands-66795.herokuapp.com/Photoshop_2022_Version_2302.pdfIn PDF document text
    • https://resistanceschool.info/wp-content/uploads/2022/07/Photoshop_2020_version_21.pdfIn PDF document text
    • https://www.matera2029.it/wp-In PDF document text
    • https://chaos-magick.com/wp-content/uploads/2022/07/Adobe_Photoshop_CS3_With_License_Key___In PDF document text
    • https://harneys.blog/wp-In PDF document text
    • http://www.easytable.online/wp-In PDF document text
    • http://www.easytable.online/wp-content/uploads/2022/07/photoshop_2021_hack__license_keygen.pdfIn PDF document text
    • https://rganunapdanquicold.wixsite.com/tiolighsinpo/post/adobe-photoshop-2021-version-22-4-2-crack-with-serial-number-full-product-key-free-32-64bitIn PDF document text
    • http://gesporsvan.yolasite.com/resources/Photoshop-CS5-Free-Download-April2022.pdfIn PDF document text
    • https://argesaranewsversra.wixsite.com/utuladun/post/adobe-photoshop-2021-version-22-4-2-jb-keygen-exe-free-win-mac-april-2022In PDF document text
    • http://echantrom.yolasite.com/resources/Adobe-Photoshop-2021-Version-222-jbkeygenexe--Download-WinMac-Latest-2022.pdfIn PDF document text
    • https://wakelet.com/wake/AtCzPR5EJyVzpBAVZrrS1In PDF document text
    • https://trello.com/c/q4rc4Cyz/64-photoshop-2022-version-2302-crack-patch-activation-key-march-2022In PDF document text
    • http://congiuwink.yolasite.com/resources/Adobe-Photoshop-2021-Version-2200-Hack-Patch--With-License-Code.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • https://rganunapdanquicold.wixsite.com/tiolighsinpo/post/adobe-In PDF document text
    • https://argesaranewsversra.wixsite.com/utuladun/post/adobe-photoshop-2021-version-22-4-2-jb-In PDF document text
    • http://echantrom.yolasite.com/resources/Adobe-In PDF document text
    • https://trello.com/c/q4rc4Cyz/64-photoshop-2022-version-2302-crack-patch-activation-key-In PDF document text
    • http://congiuwink.yolasite.com/resources/Adobe-Photoshop-2021-Version-2200-Hack-Patch--With-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    +1 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D3E 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000b52a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB52A 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.