Malicious PDF — malware analysis report

Static analysis result for SHA-256 875c05f70cb84dfc…

MALICIOUS

PDF

55.7 KB Created: 2022-12-15 17:35:18 +00:00 Authoring application: klawai (via mPDF 8.1.2) First seen: 2026-05-17
MD5: c8767db1c62dd6db34d8a7068930fa20 SHA-1: 8bd2990b9a3feb577e604c325c1ad854350883e2 SHA-256: 875c05f70cb84dfc7f0b6191a8e38b998041be6fde66b6fd5e3dcb0e94b80ad7
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0058

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://raisengine.com/?fogginess=/polysaccharide/QXV0b0NBRAQXV/releve/square/ZG93bmxvYWR8eWc3YXpkemZId3hOamN4TVRJd05URXdmSHd5TlRrd2ZId29UU2tnVjI5eVpIQnlaWE56SUZ0WVRVeFNVRU1nVmpJZ1VFUkdYUQ.distending PDF link annotation
    • https://earthoceanandairtravel.com/wp-content/uploads/2022/12/avrnis.pdfIn PDF document text
    • http://cubaricosworld.com/wp-content/uploads/2022/12/finbphil.pdfIn PDF document text
    • http://lustrousmane.com/wp-content/uploads/2022/12/lovaonao.pdfIn PDF document text
    • https://thetouringpandas.com/wp-content/uploads/2022/12/cesleli.pdfIn PDF document text
    • https://phatdigits.com/wp-content/uploads/2022/12/berwero.pdfIn PDF document text
    • https://glorygatechapel.org/wp-content/uploads/2022/12/AutoCAD__Cdigo_de_activacin_con_Keygen_Clave_de_producto_completa_X64_2022_En_Espaol.pdfIn PDF document text
    • https://lagaceta.montehermoso.com.ar/advert/como-descargar-e-instalar-autocad-en-espanol-__top__/In PDF document text
    • https://dincampinginfo.dk/wp-content/uploads/2022/12/desnek.pdfIn PDF document text
    • https://nadiasalama.com/autocad-2019-23-0-codigo-de-activacion-con-keygen-win-mac-nuevo-2022/In PDF document text
    • https://konnektion.com/advert/descarga-gratis-autocad-2017-21-0-grieta-hackeado-for-windows-x64-2023-espanol/In PDF document text
    • https://glorygatechapel.org/wp-content/uploads/2022/12/AutoCAD__Cdigo_de_activacin_con_Keygen_In PDF document text
    • https://konnektion.com/advert/descarga-gratis-autocad-2017-21-0-grieta-hackeado-for-windows-x64-In PDF document text
    • https://techplanet.today/post/descargar-bloques-gratis-de-autocad-2dIn PDF document text
    • https://techplanet.today/post/autocad-2022-241-activador-clave-de-producto-win-mac-2022-espanolIn PDF document text
    • https://techplanet.today/post/descargar-bloques-de-banos-para-autocad-linkIn PDF document text
    • https://techplanet.today/post/descargar-autocad-gratis-para-estudiantesIn PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_013_off000072b3.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_013_off000072b3.bin)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_013_off000072b3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x72B3 20400 bytes
SHA-256: b8f92d26f8a90926b7979212a4ba8101d579e0c5a4ddf8b1866a35cf052dc6ef
font_01_sfnt_off0000a980.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA980 20448 bytes
SHA-256: 168af733adadc07894713b42cf3797ac66e032dfce658b513c6158ab1d9eec63

Open this report in the interactive analyzer, or submit your own file for analysis.