Malicious PDF — malware analysis report

Static analysis result for SHA-256 8576e39d4d21b161…

MALICIOUS

PDF

127.0 KB Created: 2022-10-15 05:59:13 +00:00 Authoring application: excwal (via PDF Master 1.0.1) First seen: 2026-04-02
MD5: d6fd24e73e59f979e4ff44b93ffbd2a8 SHA-1: 402cf8621a51e1b403bd731721b5d63f66dc0098 SHA-256: 8576e39d4d21b1613ba62a7f1390919f710949d7b5a3d7223abaf94c2dca8650
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous links, several of which point to sites offering cracked software and keygens, as indicated by the 'PDF_CRACKED_SOFTWARE_SHORTLINK_LURE' and 'PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY' heuristics. The document body explicitly mentions 'Free Download Keygen Spi2 License Perkins' and provides a URL that appears to be a download gateway. This suggests the primary goal is to trick users into downloading potentially malicious software.

Machine Learning

  • Nyx PDF Classifier clean score 0.0009

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
    PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://raisengine.com/knesset/communications/ditali&RnJlZSBEb3dubG9hZCBLZXlnZW4gU3BpMiBMaWNlbnNlIFBlcmtpbnMRnJ.ZG93bmxvYWR8T1M3Wm1GNWJYeDhNVFkyTlRjek16ZzBNWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.collect PDF link annotation
    • https://cdpafrica.org/wp-content/uploads/2022/10/markzet.pdfIn PDF document text
    • https://www.lacalleloiza.com/wp-content/uploads/2022/10/Barron_S_ACT_36_2nd_Edition_Aiming_For_The_Perfect_Score_PDFpdf.pdfIn PDF document text
    • http://mirrordancehair.com/?p=15460In PDF document text
    • http://kinectblog.hu/saudi-national-formulary-latest-edition-saudi-national-formulary-latest-edition-pdf.htmlIn PDF document text
    • http://3.16.76.74/advert/presonusstudiooneproductkeytop-keygen/PDF link annotation
    • https://cambodiaonlinemarket.com/intelliscore-polyphonic-wav-to-midi-converter-7-1-crack-top/In PDF document text
    • https://crystalshine.eu/wp-content/uploads/2022/10/kalaimagal_astrology_software_in_tamil_free_208.pdfIn PDF document text
    • https://www.steppingstonesmalta.com/cinesamples-cinestrings-core-kontakt/In PDF document text
    • https://sumakart.com/hogar-dulce-hogar-marcos-brunet-libro-pdf-12/In PDF document text
    • https://connecttosources.com/wp-content/uploads/2022/10/darind.pdfIn PDF document text
    • https://www.lacalleloiza.com/wp-In PDF document text
    • http://raisengine.com/knesset/communications/ditali&rnjlzsbeb3dubg9hzcblzxlnzw4gu3bpmibmawnlbnnlifblcmtpbnmrnj.zg93bmxvywr8t1m3wm1gnwjyedhnvfkytlrjek16zzbnwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.collectIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001357.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1357 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009b43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9B43 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.