Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f72aacdd50f5dea…

MALICIOUS

PDF

47.4 KB Authoring application: Poppler-utils First seen: 2025-12-02
MD5: 78150773f1d20f67848ac53058998a99 SHA-1: 10c2cfc1145d66d0d08c3325c9e61431c135d626 SHA-256: 7f72aacdd50f5dea1cfb3014f4170c642d98a61b6f557b42664971a3475053c5
94 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nuso.venuscapital.org/uploads/2020/01/28/kixitajix_limulamiwufev_vupofexezo_rumeku.pdf PDF link annotation
    • http://wuxufij.klubok-modno.ru/uploads/2020/01/28/1937064.pdfPDF link annotation
    • http://nujiju.site111.ru/uploads/2020/01/27/df0ed12d405f.pdfPDF link annotation
    • http://doxira.davidmazurphoto.com/uploads/2020/01/27/nogapakemojobu.pdfPDF link annotation
    • http://log.novogodnie-podarki-moskva.ru/uploads/2020/01/28/6746219.pdfPDF link annotation
    • https://jikoxumuf.weebly.com/uploads/1/3/0/6/130604042/gedogoni.pdfPDF link annotation
    • http://imperiya.top/uploads/2020/01/28/rezerisiw-zujiv-rodoxegujuruluf.pdfPDF link annotation
    • https://rofokawadobox.weebly.com/uploads/1/3/0/5/130543979/8903297.pdfPDF link annotation
    • https://zemagitisexubil.weebly.com/uploads/1/3/0/5/130551002/8222419.pdfPDF link annotation
    • http://katuxazi.lucky-opros.info/uploads/2020/01/27/bb629.pdfPDF link annotation
    • http://megatest.org/uploads/2020/01/28/nejamugixetuno_gajubowaza_wopetesokegu_towipixakunopik.pdfPDF link annotation
    • http://famowi.tatarstan.travel/uploads/2020/01/27/504462ba3374453.pdfPDF link annotation
    • https://vopabibejo.weebly.com/uploads/1/3/0/4/130476266/dexuk_vepapuzo_zakaxem_wavek.pdfPDF link annotation
    • http://pedajogo.glucometer-online.com/uploads/2020/01/28/remefaxixeboxojupuk.pdfPDF link annotation
    • https://kegoxugu.weebly.com/uploads/1/3/0/4/130483109/c9308f5315fff.pdfPDF link annotation
    • http://stimullr.info/uploads/2020/01/28/9207081.pdfPDF link annotation
    • http://tinig.tushenka-opt.ru/uploads/2020/01/27/8844e2.pdfPDF link annotation
    • http://3ndfl-nalogi.ru/uploads/2020/01/27/13d3190d3d9ea0.pdfPDF link annotation
    • http://senowo.modafactory.ru/uploads/2020/01/27/rebuwaduwosibaruvo.pdfPDF link annotation
    • https://jubomusosovin.weebly.com/uploads/1/3/0/5/130588556/dirojewesuko_zesir.pdfPDF link annotation
    • http://karejebofo.gamesplusadventure.ru/uploads/2020/01/27/lotoj_famirofato.pdfPDF link annotation
    • http://0406shopps02.fun/uploads/2020/01/28/newudakivatokad_fotojif.pdfPDF link annotation
    • https://nomaxegefatadu.weebly.com/uploads/1/3/0/5/130551004/dezejejib-vapukagep.pdfPDF link annotation
    • https://nazedubuzolefu.weebly.com/uploads/1/3/0/3/130379589/424e0d45.pdfPDF link annotation
    • http://acupofh2o.net/uploads/2020/01/28/tofapuzofazakebe.pdfPDF link annotation

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001173.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1173 8120 bytes
SHA-256: ce9d7f6296ce6243902af4cd240395814a73669f17bec55ac31c24b1ac12680c

Open this report in the interactive analyzer, or submit your own file for analysis.