Malicious PDF — malware analysis report

Static analysis result for SHA-256 b61ec716cb803f6c…

MALICIOUS

PDF

109.8 KB Created: 2022-08-28 09:07:42 +02:00 Authoring application: quijanek (via PDF Master 1.0.1) First seen: 2026-07-15
MD5: a24480ccbbd779c46386d21346911d6c SHA-1: 7c8f0807939e3d9b6d20124d793c13465cff5418 SHA-256: b61ec716cb803f6c405cfad34d8b05fd63bf86a5183dffdb87e511cb7c2a7792
89 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0182

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF links to disposable redirector campaign host medium PDF_DISPOSABLE_REDIRECTOR_CAMPAIGN
    PDF's outbound link points to a throwaway redirector domain that recurs as the sole redirect across a large family of otherwise unrelated spam PDFs (movie-piracy, affiliate, and viral-link lures). These domains appear on no reputable list and exist only to funnel openers into malvertising / scam / download chains.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://byltly.com/2suKbi PDF link annotation
    • https://www.luoxingyuan.com/wp-content/uploads/2022/08/fausvai.pdfIn PDF document text
    • https://quickpro.site/wp-content/uploads/2022/08/Descargar_Emaksimus_Full_Gratis_En_Esparar_1.pdfIn PDF document text
    • https://www.voyavel.it/kbc-font-18-download-upd/In PDF document text
    • https://mindspa-india.com/wp-content/uploads/2022/08/olivchi.pdfIn PDF document text
    • https://www.travelrr.com/garritan-aria-player-fix-keygen-download-multi-champion-tradi/In PDF document text
    • https://idenjewelry.com/wp-content/uploads/makber.pdfIn PDF document text
    • https://greenearthcannaceuticals.com/edgecam-2011-r1-sp3-download-updated-portugues-14/In PDF document text
    • http://pzn.by/?p=80749In PDF document text
    • http://jwmarine.org/ulead-cool-3d-production-studio-3-5-free-download-crack-verified/In PDF document text
    • https://buycoffeemugs.com/pl-2000-astrology-software-free-49l-portable/In PDF document text
    • https://divyendurai.com/tufos-contos-animados-verified/In PDF document text
    • https://gaudyspot.com/wp-content/uploads/2022/08/Vyasa_Mahabharata_In_Telugu_Pdf_Free_VERIFIED_Download.pdfIn PDF document text
    • https://riberadelxuquer.com/wp-content/uploads/2022/08/Vl813_Driverexe_NEW.pdfIn PDF document text
    • https://atiqxshop.nl/wp-content/uploads/2022/08/billa_2_tamil_full_movie_download.pdfIn PDF document text
    • http://domchoset.yolasite.com/resources/Autodesk-Revit-2018-Win64-rar-EXCLUSIVE.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001202.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1202 84652 bytes
SHA-256: 4afa1760e2b1183eedc04ece45e6ca142828bb1815d2ec2d36bc01b6dcd9471b
font_01_sfnt_off00009985.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9985 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261