Malicious PDF — malware analysis report

Static analysis result for SHA-256 73f5bf066631b464…

MALICIOUS

PDF

83.7 KB Authoring application: https072057057www056examdiscuss056com057College055Admission057exam057PMHNP057 First seen: 2026-06-10
MD5: 348e31d84b0b57bd925ee235a84dabc4 SHA-1: 7006fb6884894d57fa226db77e7d17bb9e7b7296 SHA-256: 73f5bf066631b464cb2283ee04114f37b92eec7f911dac7e97d625de2c761545
80 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0217

Heuristics 4

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI low PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.examdiscuss.com/College-Admission/exam/PMHNP/ In PDF document text
    • https://erectiledysfunctionmedicinesus.com/?s=Valid%20Exam%20PMHNP%20Preparation%20%25f0%259f%25a5%2590%20Reliable%20PMHNP%20Cram%20Materials%20%25f0%259f%2598%258c%20PMHNP%20Preparation%20Store%20%25f0%259f%2598%2590%20Open%20%25e2%25ae%2586%20www.pdfvce.com%20%25e2%25ae%2584%20and%20search%20for%2In PDF document text
    • https://drive.google.com/openPDF link annotation
    • https://drive.google.com/open?id=1xrFU8PwCQKyKtvbUqQXblzl8-Dt54RZJPDF link annotation
    • https://montycrrw372994.bloggosite.com/49523007/ztca-valid-exam-review-ztca-test-torrentIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001765.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1765 21844 bytes
SHA-256: 2a44bdeadc71dce4f8ef6431fd5ca6f0c052f2a67b4575591a83e575b445cc5d
font_01_sfnt_off00004521.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4521 24428 bytes
SHA-256: 9f8cd68f0a6d29e7622ef72b68bd9706d645b1762412cfa51d7d4ed5d23b63a9
font_02_sfnt_off0001141d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1141D 4080 bytes
SHA-256: 610a6b329db2b826a0e8fba8e3cc386ba410aaa74885cb047f2af662114aa17c
font_03_sfnt_off00012178.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12178 2720 bytes
SHA-256: 2361c82e15342ea27bf4ce746df6d72300cc059365bc8165f80c0a0001d1a3c4

Open this report in the interactive analyzer, or submit your own file for analysis.