Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b849fd38ad8294c…

MALICIOUS

PDF

118.6 KB Created: 2022-07-26 01:06:14 +00:00 Authoring application: ojibhad (via PDF Master 1.0.1) First seen: 2026-05-05
MD5: 27e3b3055ab3d2104417d027e34cf1a1 SHA-1: c5b3e780aba7520164bac5c30422c58d1862cbeb SHA-256: 8b849fd38ad8294c809d4ff3b449a52a9e2c44bbdd3c69413e2a38b736541ecf
164 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0017

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://godsearchs.com/infantry/ZG93bmxvYWR8dVkyZGpWMU5IeDhNVFkxT0RJeE9EazROWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA&acevedo/graaff/kennsington/jian/TmV0c3BvdCBQcm8gRnVsbCBDcmFjayAyMgTmV.melanocyte PDF link annotation
    • https://endleleni.com/wp-content/uploads/2022/07/scx5600_adjsw_v0107_20070613.pdfIn PDF document text
    • https://www.immobiliarelamaison.eu/wp-content/uploads/2022/07/Pops_Converter_V_16.pdfIn PDF document text
    • https://aiplgurugram.com/2022/07/26/circuit-wizard-3-free-download-full-version-link/In PDF document text
    • https://muslimprofessionalsgh.org/advert/motu-patlu-king-of-kings-movie-download-hd-1080p-install/In PDF document text
    • https://lockbrotherstennis.com/wp-content/uploads/2022/07/Sierra_child_model_sets_125_2_bonus_sets.pdfIn PDF document text
    • https://lectomania.com/wp-content/uploads/2022/07/Zeynel_Dinler_Kpss_Iktisat_Kpsspdf.pdfIn PDF document text
    • http://www.debati.online/wp-content/uploads/2022/07/delphi_and_c_builder_decompiler_crack.pdfIn PDF document text
    • https://www.opticnervenetwork.com/wp-content/uploads/2022/07/ingrdar.pdfIn PDF document text
    • https://www.9mesi.eu/wp-content/uploads/2022/07/saukam.pdfIn PDF document text
    • https://www.dancesocksbcn.com/advert/elbeyli-cccam-server-hack-v1-upd/In PDF document text
    • https://sayafmcg.com/wp-content/uploads/2022/07/icoyote_gratuit_android_crack_18.pdfIn PDF document text
    • https://armadalaptop.com/wp-content/uploads/2022/07/D3scene_Dll_Injector_24.pdfIn PDF document text
    • https://homedust.com/automobilista-brit-pack-activation-key-generator/In PDF document text
    • https://xn--xvaos-qta.net/wp-content/uploads/2022/07/warljar.pdfIn PDF document text
    • https://polskikapital.org/wp-content/uploads/2022/07/basqxylo.pdfIn PDF document text
    • https://perlevka.ru/advert/refrigeration-and-air-conditioning-by-rk-rajput-pdf-free-download-free/In PDF document text
    • http://yorunoteiou.com/?p=579880In PDF document text
    • https://ufostorekh.com/wp-content/uploads/2022/07/VisTitle_20_3D_Title_Effects_PlugIn_For_EDIUSrar_VERIFIED.pdfIn PDF document text
    • https://gretchenscannon.com/wp-content/uploads/2022/07/latrken.pdfIn PDF document text
    • https://piamet.com/wp-content/uploads/2022/07/skyrim_update_19_download_non_steam.pdfIn PDF document text
    • https://lockbrotherstennis.com/wp-In PDF document text
    • https://ufostorekh.com/wp-In PDF document text
    • http://godsearchs.com/infantry/zg93bmxvywr8dvkyzgpwmu5iedhnvfkxt0rjee9eazrowhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda&acevedo/graaff/kennsington/jian/tmv0c3bvdcbqcm8grnvsbcbdcmfjayaymgtmv.melanocyteIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002b08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B08 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off0000b2f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB2F4 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.