Malicious PDF — malware analysis report

Static analysis result for SHA-256 a64f1f15d7fd5d6b…

MALICIOUS

PDF

26.1 KB Created: 2023-01-20 00:50:20 +01:00 Authoring application: 376377000c000h000r000y000s000a000l000u (via GPL Ghostscript 9.55.0) First seen: 2026-04-13
MD5: 543555013496db90727c24787be2e757 SHA-1: e438cd13901cde23e1e3c7363fed9949e84b9cc8 SHA-256: a64f1f15d7fd5d6be0eb84e4bed209ac4fdc47e390581b0e59c66f9d900ca06e
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0315

Heuristics 4

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tinurll.com/2sD9D9 PDF link annotation
    • https://marido-caffe.ro/2023/01/14/arcade-tycoon-free-download-for-pcfull-setup-exclusive/In PDF document text
    • http://www.360sport.it/advert/u-r-my-jaan-movie-free-verified-download-kickass/In PDF document text
    • https://amnar.ro/microsoft-office-365-home-premium-product-key-free-download-work/In PDF document text
    • https://www.aussnowacademy.com/foxit-advanced-pdf-editor-310-serial-322-2021/In PDF document text
    • https://esma.love/shop/downloadflstudio10fullversionwithcrack/In PDF document text
    • https://sipepatrust.org/download-palak-4-720p-in-hindi-work/In PDF document text
    • http://jameschangcpa.com/advert/captainamericacivilwarenglishmovie1080pdownloadutorrent/In PDF document text
    • https://kitchenwaresreview.com/full-akibat-guna-guna-istri-muda-link/In PDF document text
    • https://www.iprofile.it/wp-content/uploads/2023/01/Edraw-Max-7-License-Name-And-Cod.pdfIn PDF document text
    • https://moronencaja.com/wp-content/uploads/2023/01/Solucionario-Electronica-De-Potencia-Rashidzip.pdfIn PDF document text
    • https://myequipmentfunder.com/wp-content/uploads/2023/01/edrnan.pdfIn PDF document text
    • http://milanochronicles.com/winrar-64-bit-free-download-full-version-deutsch/In PDF document text
    • http://playfanfgame.com/wp-content/uploads/2023/01/uhylnav.pdfIn PDF document text
    • https://greenearthcannaceuticals.com/one-2-ka-4-2000-mp3-vbr-320kbps/In PDF document text
    • https://www.scoutgambia.org/volcano-high-wasango-2001dvdrip-divx-ita-ac3/In PDF document text
    • https://maltymart.com/advert/doa-jawsyan-kabir-pdf-new/In PDF document text
    • https://duplicazionechiaveauto.it/mcafee-activation-key-crack-install/In PDF document text
    • https://ipuducherry.in/wp-content/uploads/2023/01/immofryt.pdfIn PDF document text
    • https://perlevka.ru/advert/chimp-rewriter-pro-v20x-portable-cracked-rib/In PDF document text
    • https://www.mein-hechtsheim.de/advert/simapro-7-download-crack-93/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002db7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DB7 4032 bytes
SHA-256: 469cf177c63749afe949bd1ed0aba40d71e6a2dd811259a40b706c9cf46ba907
font_01_sfnt_off0000398b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x398B 3728 bytes
SHA-256: ee9e02d731d306a0e2deccfd2cdc2aaad7d6063c3b42989573b8b693b8f0e52d
font_02_sfnt_off00004466.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4466 8876 bytes
SHA-256: 7a413cdc5a5578abc72446a0902647b49683f2d366265f349fcf23aaa30bcfd2

Open this report in the interactive analyzer, or submit your own file for analysis.