Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcc08addb09f6d2a…

MALICIOUS

PDF

113.0 KB Created: 2022-09-09 11:58:57 +00:00 Authoring application: arischan (via PDF Master 1.0.1) First seen: 2026-06-02
MD5: 17fe9328def60fa13eadce16018eab50 SHA-1: ce1ca3e60c9c84cd554c3821676966e573636501 SHA-256: bcc08addb09f6d2a506d3404de25487733dd0170889bc1a670036b490b8800e5
64 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestsmartfind.com/cling/frayed/enthralled/ZG93bmxvYWR8UFA3TjJ4d2EzeDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/frought/RlVMTCBBZHVsdCBTaG93IFh4eCBTa3lyaW0gTW9kIDM0RlV...dpms PDF link annotation
    • https://prelifestyles.com/wp-content/uploads/2022/09/makwind.pdfIn PDF document text
    • https://finddentalpractice.com/wp-content/uploads/2022/09/khrlude.pdfIn PDF document text
    • http://mariana-flores-de-camino.com/?p=21935In PDF document text
    • https://www.ocacp.com/wp-content/uploads/2022/09/narehard-1.pdfIn PDF document text
    • https://marido-caffe.ro/2022/09/09/chakdeindia1moviefulldownload-new/In PDF document text
    • https://brandyallen.com/2022/09/09/hd-online-player-dangal-tamil-full-movie-download-720-__hot__/In PDF document text
    • https://gjurmet.com/en/philibao-ph-6688-datase-software/In PDF document text
    • http://enricmcatala.com/?p=54980In PDF document text
    • https://iled.in/wp-content/uploads/2022/09/FULL_Starcraft_Gundam_Century_Full_Version_Download_Free_PATCHED.pdfIn PDF document text
    • https://www.charitygolftournamentteesigns.com/conny-mendez-libros-pdf-free-exclusive/In PDF document text
    • https://hard-times.us/wp-content/uploads/2022/09/Delfin_Arbeitsbuch_Antworten_Pdf_Free_143.pdfIn PDF document text
    • https://malekrealty.org/download-discografia-de-bordon-4-16-link-129311/In PDF document text
    • https://volektravel.com/easy-mp3-cutter-3-0-serial-rar-2021/In PDF document text
    • http://clubonlineusacasino.com/cabal-macro-bot-download-best/In PDF document text
    • https://serippy.com/frontechsounddriverjil0704-2021/In PDF document text
    • http://www.kiwitravellers2017.com/2022/09/09/serial-codes-for-battle-for-middle-earth/In PDF document text
    • https://www.mozideals.com/advert/solucionario-de-matematica-1-edwin-galindo-exclusive/In PDF document text
    • https://blossom.works/wp-content/uploads/2022/09/mariregy.pdfIn PDF document text
    • http://ticketguatemala.com/isunshare-windows-password-genius-exclusive-full-crack-kid/In PDF document text
    • https://urmiabook.ir/wilcomembroiderystudiov90sp4fullcdmultilingualrar-hot/In PDF document text
    • https://iled.in/wp-content/uploads/2022/09/FULL_Starcraft_Gundam_Century_Full_Version_Download_In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16BB 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009ea7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9EA7 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261