Malicious PDF — malware analysis report

Static analysis result for SHA-256 93290f925c1e3505…

MALICIOUS

PDF

115.8 KB Created: 2022-07-27 08:56:20 +00:00 Authoring application: marbryd (via PDF Master 1.0.1) First seen: 2026-06-03
MD5: 7effbdf1060110e4af0ce1563453d2f1 SHA-1: 602ec06e8ad93151ed558783192a905d04b0270e SHA-256: 93290f925c1e3505274efe574f2397427212b3c654734f1c7dd0dde336086462
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardlyfind.com/arlingtonians/ZG93bmxvYWR8dmMyT1hCNk5ueDhNVFkxT0RJeE9UUTNNM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/betwen.bono?commentaries=RnJpdHogVW5kIEZlcnRpZyAxIENyYWNrRnJ& PDF link annotation
    • https://www.theblender.it/descargar-pdf-translator-multilizer-v2-con-better-crack/In PDF document text
    • https://www.thepostermafia.com/2022/07/27/pcg-2005-malgache-pdf/In PDF document text
    • https://volektravel.com/nuance-omnipage-professional-18-1-multilanguage-iso/In PDF document text
    • https://captainseduction.fr/ez-grabber-usb-dvd-maker-capture-rar/In PDF document text
    • https://yorunoteiou.com/wp-content/uploads/2022/07/Cracked_Steam_V4rar_Free_Download_NEW.pdfIn PDF document text
    • https://www.travelrr.com/gnarls-barkley-st-elsewhere-album-zip/In PDF document text
    • http://www.khybersales.com/2022/07/27/iw5mp-cegexe-null-0x80041002/In PDF document text
    • http://www.ganfornina-batiment.com/2022/07/27/syncdocs-6-93-unlimited-google-drive-quota-and-accounts-serial-key-keygen-install/In PDF document text
    • https://mac.com.hk/advert/best-download-keygen-xforce-for-autocad-mobile-2014/In PDF document text
    • https://www.techclipse.com/jodha-akbar-full-movie-tamil-download-free/In PDF document text
    • https://rhea-recrutement.com/wp-content/uploads/2022/07/4uKey_2011_Crack_Plus_Latest_Registration_Code_LINK.pdfIn PDF document text
    • http://yiyo.es/wp-content/uploads/2022/07/Download_Anime_Voices_Of_A_Distant_Star_Sub_Indo_Movie_UPD.pdfIn PDF document text
    • https://paintsghana.com/advert/company-of-heroes-tales-of-valor-2-500-0-127-7-trainer-25-hot/In PDF document text
    • https://choicemarketing.biz/lynda-��-revit-2019-essential-training-for-mep-metric-better/In PDF document text
    • http://xn----8sbdbpdl8bjbfy0n.xn--p1ai/wp-content/uploads/2022/07/Aimersoft_Dvd_Creator_265_Serial_Key.pdfIn PDF document text
    • https://startpointsudan.com/index.php/2022/07/27/driver-qualcomm-msm-device-lumia-720-zip-hot/In PDF document text
    • https://cb4.travel/wp-content/uploads/2022/07/Audio_Drivers_For_Intel_Core_2_Duo_E4500_BETTER.pdfIn PDF document text
    • http://freemall.jp/akira-full-movie-in-hindi-720p-download-movie-free.htmlIn PDF document text
    • http://findmallorca.com/ativador-windows-8-download-pc-hot/In PDF document text
    • https://elektrobest.de/wp-content/uploads/2022/07/Image_Rescue_5_Keygen_Torrent.pdfIn PDF document text
    • https://www.theblender.it/descargar-pdf-translator-multilizer-v2-con-better-In PDF document text
    • https://volektravel.com/nuance-omnipage-professional-18-1-multilanguage-In PDF document text
    • https://yorunoteiou.com/wp-In PDF document text
    • http://www.ganfornina-batiment.com/2022/07/27/syncdocs-6-93-unlimited-In PDF document text
    • https://mac.com.hk/advert/best-download-keygen-xforce-for-autocad-In PDF document text
    • https://rhea-recrutement.com/wp-content/uploads/2022/07/4uKey_2011_CrackIn PDF document text
    • http://yiyo.es/wp-content/uploads/2022/07/Download_Anime_Voices_Of_A_DistIn PDF document text
    • https://paintsghana.com/advert/company-of-heroes-tales-of-In PDF document text
    • https://choicemarketing.biz/lynda-��-revit-2019-essential-training-for-mep-In PDF document text
    • http://xn----8sbdbpdl8bjbfy0n.xn--p1ai/wp-In PDF document text
    • https://startpointsudan.com/index.php/2022/07/27/driver-qualcomm-msm-In PDF document text
    • https://cb4.travel/wp-content/uploads/2022/07/Audio_Drivers_For_Intel_Core_2In PDF document text
    • https://elektrobest.de/wp-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000124c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x124C 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009a38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9A38 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261