Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6edec04dec94b69…

MALICIOUS

PDF

125.4 KB Created: 2022-06-09 15:08:13 +02:00 Authoring application: nolgas (via PDF Master 1.0.1) First seen: 2026-05-16
MD5: 1ac024a42b7514c98a7fa2595f2d693a SHA-1: 42c51d8a11ee3d76dfba716846ccc67449262886 SHA-256: b6edec04dec94b691f95dd5323448d5a67c64bed8b874db000416f21212e2c26
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0015

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Cracked-software lure uses shortlink/download gateway critical PDF_CRACKED_SOFTWARE_SHORTLINK_LURE
    PDF visible text advertises a crack, serial number, archive, or pirated-software download and pairs it with a shortlink or encoded download gateway. This is a high-confidence social-engineering carrier for unwanted software or droppers; the PDF itself is not a parser exploit.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/tectonic/ditching/?Q2FyIE1lY2hhbmljIFNpbXVsYXRvciAyMDE1IEdvbGQgRWRpdGlvbiB2MS4xLjYuMCBJbmNsIEFMTCBETEMgZnJlZSBkb3dubG9hZAQ2F=puccio&ZG93bmxvYWR8VFcxTVc4NGIzeDhNVFkxTkRjM056QXpNbng4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA=cheese PDF link annotation
    • https://www.skiplace.it/wp-content/uploads/2022/06/karoill.pdfIn PDF document text
    • https://insightkorea.or.kr/blog/index.php?entryid=3566In PDF document text
    • http://pearlhmmph.com/2022/06/pvsyst-6-1-7-keygen-_verified_/In PDF document text
    • https://www.aliyue.net/wp-content/uploads/2022/06/moyea_ppt_to_video_converter_crack_serial_keys.pdfIn PDF document text
    • https://indiatownship.com/principles-of-electrical-engineering-et-115-book-free-download-new/In PDF document text
    • https://rednails.store/wp-content/uploads/2022/06/Online_KMS_Activation_Script_50_Full.pdfIn PDF document text
    • http://www.chelancove.com/wp-content/uploads/2022/06/Farzand_E_Pakistan_Book_Pdf_12.pdfIn PDF document text
    • https://telebook.app/upload/files/2022/06/EGMA4oC3fTKenTLePjdQ_09_e7af4f916780fa25a3662b7f5e0a468a_file.pdfIn PDF document text
    • https://socialcaddiedev.com/discografia-de-juan-pardo-megaupload-top/In PDF document text
    • https://bastakiha.ir/wp-content/uploads/2022/06/maihdom.pdfIn PDF document text
    • https://armslengthlegal.com/wp-content/uploads/2022/06/gebhcha.pdfIn PDF document text
    • https://goosetopia.com/wp-content/uploads/2022/06/Hexagon_PPM_COADE_CAESAR_II_2009_Free_Download.pdfIn PDF document text
    • http://inventnet.net/advert/generic-navi900-eu-the-best-italia-europe-navi900-gmap/In PDF document text
    • https://www.mein-hechtsheim.de/advert/program-do-hakowania-facebooka-top-download/In PDF document text
    • https://www.sertani.com/upload/files/2022/06/KFbNx37wYJCalLNVOme4_09_e7af4f916780fa25a3662b7f5e0a468a_file.pdfIn PDF document text
    • https://www.speakfreelee.com/upload/files/2022/06/iQkldUwJ8uVFELkT7Lu6_09_09038419c7ad44aa73aeb9c4748fc3b9_file.pdfIn PDF document text
    • https://21conecta.com/wp-content/uploads/2022/06/Download_De_Carros_Brasileiros_Para_Need_For_Speed_Most_Want.pdfIn PDF document text
    • https://www.7desideri.it/?p=10138In PDF document text
    • https://facethai.net/upload/files/2022/06/kJeEuTMpKfttyIoZ1hLe_09_e7af4f916780fa25a3662b7f5e0a468a_file.pdfIn PDF document text
    • http://evacdir.com/tectonic/ditching/?q2fyie1ly2hhbmljifnpbxvsyxrvciaymde1iedvbgqgrwrpdglvbib2ms4xljyumcbjbmnsiefmtcbetemgznjlzsbkb3dubg9hzaq2f=puccio&zg93bmxvywr8vfcxtvc4ngizedhnvfkxtkrjm056qxpnbng4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda=cheeseIn PDF document text
    • https://skilled-space.sfo2.digitaloceanspaces.com/2022/06/Vp_eye_60_free_35.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000136b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x136B 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000c14e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC14E 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.