Malicious PDF — malware analysis report

Static analysis result for SHA-256 941d1687fa75a324…

MALICIOUS

PDF

144.8 KB Created: 2022-07-01 05:07:10 +02:00 Authoring application: darieir (via PDF Master 1.0.1) First seen: 2026-06-12
MD5: be6c91419e1c047119f882ba1db91d46 SHA-1: 833d0a8a182a03cd6ad8543348c2c271f7a12433 SHA-256: 941d1687fa75a324c3bd6e042861c5b021aef15483c9abd5b5110b38b41a0f70
104 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0077

Heuristics 4

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
    PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/pantelleria/ZG93bmxvYWR8cnIzTVRCNWJIeDhNVFkxTmpZME1EZ3hOM3g4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/kqed.javanese?linearly=puddler.cGhvdG9zaG9wIHN0eWxlcyBwYWNrIGZyZWUgZG93bmxvYWQcGh.wailers PDF link annotation
    • https://kjvreadersbible.com/the-color-fusion-photoshop-actions-will-add-a-ripple-filter-to-the-detail-layer-and-fades-out-the-detail-layer-free/In PDF document text
    • https://savosh.com/adobe-photoshop-for-windows-7/In PDF document text
    • https://www.mil-spec-industries.com/system/files/webform/how-to-download-photoshop-in-laptop-windows-10.pdfIn PDF document text
    • http://brown-about-town.com/wp-content/uploads/2022/07/Photoshop_2020_Photoshop_CC.pdfIn PDF document text
    • https://awamagazine.info/advert/how-to-make-passport-photo-size-online-here-are-some-easy-steps/In PDF document text
    • https://www.oldlyme-ct.gov/sites/g/files/vyhlif3616/f/uploads/application_burn_permit.pdfIn PDF document text
    • https://khadijahshowroom.com/2022/07/01/ridgid-3d-60-free-luts/In PDF document text
    • http://prabhatevents.com/input-materials-material-list-in-photoshop/In PDF document text
    • https://www.careerfirst.lk/sites/default/files/webform/cv/download-luts-for-photoshop.pdfIn PDF document text
    • https://lucaslaruffa.com/adobe-photoshop-cc-2020-free-download/In PDF document text
    • https://www.seacliff-ny.gov/sites/g/files/vyhlif3786/f/uploads/notice.pdfIn PDF document text
    • https://bikerhall.com/upload/files/2022/07/dfdsU6tM5VEwTkQXyLX5_01_18a9c4dd24626659704f9484645a7a88_file.pdfIn PDF document text
    • https://frameofmindink.com/wp-content/uploads/2022/06/jakpeac.pdfIn PDF document text
    • https://germanconcept.com/how-to-download-photoshop-cs6-full-version-without-crack-free/In PDF document text
    • http://nmcb4reunion.info/wp-content/uploads/2022/07/How_to_Install_Adobe_on_Mac_for_free_for_life_2022.pdfIn PDF document text
    • https://www.sb20ireland.com/advert/photoshop-for-mac-download-for-windows-10/In PDF document text
    • https://oknit.ru/wp-content/uploads/2022/07/photoshop_cs_70_free_download.pdfIn PDF document text
    • http://barrillos.org/2022/07/01/how-to-get-adob-photoshop-fix-license-key-for-8-0/In PDF document text
    • https://cursos-bonificados.com/noticias/any-free-photoshop-plugins-that-work-with-scanner-mfc-i-700/In PDF document text
    • https://www.spasvseyarusi.ru/advert/where-to-download-adobe-photoshop-7/In PDF document text
    • http://evacdir.com/pantelleria/zg93bmxvywr8cniztvrcnwjiedhnvfkxtmpzme1ez3hom3g4twpvm05iedhlrtbwsuhkbflxuxrzbxh2wnlcyljtrnpkq0jiulu1za/kqed.javanese?linearly=puddler.cghvdg9zag9wihn0ewxlcybwywnrigzyzwugzg93bmxvywqcgh.wailersIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000296c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x296C 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000d74f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD74F 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.