Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d0b95b4e83942f6…

MALICIOUS

PDF

108.9 KB Created: 2022-11-26 08:22:11 +00:00 Authoring application: marcha (via PDF Master 1.0.1) First seen: 2026-05-22
MD5: 548701f2eae7697ef142f412f7d3c35f SHA-1: 48accc95c254ab0cc0e5351e469bac8d9ae748a5 SHA-256: 9d0b95b4e83942f6dc8cd96d899485c32dae22450cfe188ce9000725be961dff
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 3

  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emailgoal.com/beech/benfotiamine/packing.alibaba?/c2V0cmEgcyAzMTUgbmYgb21zaSBkb3dubG9hZAc2V/recap/ZG93bmxvYWR8OEtUTlRGbWJIeDhNVFkyT1RReE5qUXlPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.republican PDF link annotation
    • https://studiolight.nl/wp-content/uploads/2022/11/delbarc.pdfIn PDF document text
    • https://immobiliarelariviera.com/wp-content/uploads/2022/11/tamvasi.pdfIn PDF document text
    • https://eskidiyse.com/index.php/seisimager-pickwin-v3-02-with-plotrefa-v2-68-by-shock/In PDF document text
    • https://www.sport1ne.com/baseball-snakes-and-summer-squash-pdf-download-upd/In PDF document text
    • https://itoflies.com/aimersoft-drm-media-converter-160-keygen-idm101-47-2021/In PDF document text
    • http://subsidiosdelgobierno.site/?p=36281In PDF document text
    • https://srkvilaskodaikanal.com/2022/11/26/al-akhdari-arabe-francais-pdf-14/In PDF document text
    • https://rsmerchantservices.com/heinemann-elt-toefl-preparation-course-audio/In PDF document text
    • https://dottoriitaliani.it/ultime-notizie/senza-categoria/wondershare-pdfelement-professional-v6-1-0-2364-patch-sh-64-bit/In PDF document text
    • https://newsbaki.com/wp-content/uploads/2022/11/lignava.pdfIn PDF document text
    • http://emailgoal.com/beech/benfotiamine/packing.alibaba?/c2v0cmegcyazmtugbmygb21zasbkb3dubg9hzac2v/recap/zg93bmxvywr8oetutlrgbwjiedhnvfkyt1rree5quxlpwhg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda.republicanIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D7 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009ac3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9AC3 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261

Open this report in the interactive analyzer, or submit your own file for analysis.