Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c88fa84021ac839…

MALICIOUS

PDF

126.1 KB Created: 2022-06-09 19:32:18 +02:00 Authoring application: triacri (via PDF Master 1.0.1) First seen: 2026-05-05
MD5: ee519331dd6bb3b643dff9a1c8df7b44 SHA-1: 779b269042b041635edacd598960194b7058287c SHA-256: 9c88fa84021ac839cc0a4fcf918df0d49f3fe3fffa85c4048524c6cb3328ac37
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/?bayan=/volatilization/espanoles/mycoplasmas/shipwreck/oolongs/powerpay/ZG93bmxvYWR8UzhoT0hwak1IeDhNVFkxTkRjNE1EYzROM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.ZG93bmxvYWQgeGZvcmNlIGtleWdlbiBNYXlhIExUIDIwMTcgNjQgYml0IHBhdGNoZG9 PDF link annotation
    • https://www.nooganightlife.com/wp-content/uploads/2022/06/VSO_Convert_X_to_DVD3_Serial_Key_download_pc.pdfIn PDF document text
    • https://blankbookingagency.com/wp-content/uploads/2022/06/caeadm.pdfIn PDF document text
    • https://zeroimpact-event.com/wp-content/uploads/2022/06/rasger.pdfIn PDF document text
    • https://shopuskart.com/wp-content/uploads/2022/06/gasturb_12_crackedrar.pdfIn PDF document text
    • https://sawkasetworld.net/upload/files/2022/06/f9JwDZFFmzvtpIj4co5W_09_eb6ee8dbe5dcd87f0523af94574c5764_file.pdfIn PDF document text
    • https://www.hony.nl/vacatures/my-sabre-red-workspace-download-fix/In PDF document text
    • http://op-immobilien.de/?p=1562In PDF document text
    • http://communitytea.org/wp-content/uploads/2022/06/Bajrangi_Bhaijaan_Movie_Review.pdfIn PDF document text
    • https://travelwithme.social/upload/files/2022/06/xmh5siZeqzJAeOa6aHqi_09_eb6ee8dbe5dcd87f0523af94574c5764_file.pdfIn PDF document text
    • https://thesciencestations.com/download-jogo-cadilac-dinossauro-ps2/In PDF document text
    • http://www.midwestmakerplace.com/?p=10449In PDF document text
    • https://btimes.my/159744-samsung-2g-tool-v3-5-0032-rarIn PDF document text
    • https://luxurygamingllc.com/kammath-and-kammath-malayalam-full-movie-dvdrip-torrent-38/In PDF document text
    • https://gainvestwp.s3.us-east-2.amazonaws.com/wp-content/uploads/2022/06/09133217/vladberw.pdfIn PDF document text
    • http://4uall.net/2022/06/09/download-dodo-bot-ts980x/In PDF document text
    • https://ayoikut.com/advert/mail-merge-toolkit-with-crack-link/In PDF document text
    • https://matzenab.se/wp-content/uploads/2022/06/mantile.pdfIn PDF document text
    • https://www.fooos.fun/social/upload/files/2022/06/1HlzbcX4ZNHk3X66gfqA_09_eb6ee8dbe5dcd87f0523af94574c5764_file.pdfIn PDF document text
    • https://ultraway.org/wp-content/uploads/2022/06/jashham.pdfIn PDF document text
    • http://evacdir.com/?bayan=/volatilization/espanoles/mycoplasmas/shipwreck/oolongs/powerpay/zg93bmxvywr8uzhot0hwak1iedhnvfkxtkrjne1eyzrom3g4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.zg93bmxvywqgegzvcmnligtlewdlbibnyxlhiexuidiwmtcgnjqgyml0ihbhdgnozg9In PDF document text
    • https://negchechirumoss.wixsite.com/aspasmiywee/post/3dsky-pro-3d-models-collectionIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000189f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x189F 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000c682.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC682 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.