Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6ea211d69561e09…

MALICIOUS

PDF

124.7 KB Created: 2022-06-12 08:13:25 +02:00 Authoring application: lauann (via PDF Master 1.0.1) First seen: 2026-05-17
MD5: c6007e641001164f5cef87826f4e0364 SHA-1: 1e972fd21d6dcbba96d7239445e752a8ead20362 SHA-256: b6ea211d69561e09e768b565c2d298fa121b9b940a8369e25bdea74d3b05f465
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0020

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/composites.ZG93bmxvYWR8bEQwWTNscGQzeDhNVFkxTkRrNE9URTJNbng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/irish/orotina.builing?TWljaGFlbCBCdWJsZSBDcmF6eSBMb3ZlIChTcGVjaWFsIEVkaXRpb24pIDIwMDkuemlwLnJhcgTWl PDF link annotation
    • https://limitless-brook-40856.herokuapp.com/Music_Wars_Rebirth_2_Rapidshare.pdfIn PDF document text
    • http://www.ndvadvisers.com/qt-hwid-generator-epub/In PDF document text
    • http://persemediagroup.com/virtual-desktop-v1-3-vr-__exclusive__-download/In PDF document text
    • https://www.weactgreen.com/upload/files/2022/06/tpA86Ce2VeavCGBc9aQM_12_e43859b7dd9363667858a23b81d8d452_file.pdfIn PDF document text
    • https://boatripz.com/wp-content/uploads/2022/06/Pc_Remote_Controller_Activation_Key.pdfIn PDF document text
    • https://t4travel.club/wp-content/uploads/2022/06/Afro_Cuban_Conga_Rhythms_32pdf.pdfIn PDF document text
    • https://earthoceanandairtravel.com/2022/06/12/the-java-programming-language-4th-edition-pdf-free-download/In PDF document text
    • http://babussalam.id/?p=7975In PDF document text
    • https://parleafrique.com/wp-content/uploads/2022/06/Serato_Sample_v120_CEVR.pdfIn PDF document text
    • https://jelenalistes.com/wp-content/uploads/2022/06/opagal.pdfIn PDF document text
    • https://www.afaceripromo.ro/wp-content/uploads/2022/06/simojasi.pdfIn PDF document text
    • https://dtatprint.com/wp-content/uploads/2022/06/Microsoft_Office_Professional_Plus_2019_Version_1902_Build_1132820158_ISO.pdfIn PDF document text
    • https://greenglobalist.com/food-agriculture/aquaculture/download-crystal-report-11-runtimeIn PDF document text
    • https://kirschenland.de/wp-content/uploads/2022/06/rangjac.pdfIn PDF document text
    • https://lsvequipamentos.com/wp-content/uploads/2022/06/yesekayl.pdfIn PDF document text
    • https://natsegal.com/wp-content/uploads/2022/06/dshow_player_captureexe_download_adobeinstmank.pdfIn PDF document text
    • https://connectingner.com/2022/06/12/lord-of-the-rings-conquest-razor-crack-fix-_top_/In PDF document text
    • https://mahoganyrevue.com/advert/topazclean310serialupd-keygen/In PDF document text
    • https://mysterious-cliffs-51366.herokuapp.com/shankaf.pdfIn PDF document text
    • https://www.samartheducation.org/wp-content/uploads/2022/06/Free_Pdf_Playboy_Magazine_Cindy_Crawford_TOP.pdfIn PDF document text
    • http://evacdir.com/composites.zg93bmxvywr8beqwwtnscgqzedhnvfkxtkrrne9urtjnbng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/irish/orotina.builing?twljagflbcbcdwjszsbdcmf6esbmb3zlichtcgvjawfsievkaxrpb24pidiwmdkuemlwlnjhcgtwlIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: shared payload 70003282ec 3 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000120e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x120E 120244 bytes
SHA-256: 70003282ec34aefac30b94caee1246840bbab90e19f1422db5c6752a623b1548
font_01_sfnt_off0000c028.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC028 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.