Malicious PDF — malware analysis report

Static analysis result for SHA-256 bcc8203a2ba95dcc…

MALICIOUS

PDF

113.0 KB Created: 2022-09-11 09:19:02 +00:00 Authoring application: shaxil (via PDF Master 1.0.1) First seen: 2026-06-02
MD5: 3b2f5eb4ec484b35c9a84ed0c4df3078 SHA-1: 81ae984ababb6aa6fef29052997b96507b671345 SHA-256: bcc8203a2ba95dcc297d8ae28f93deac0f7181e52a86c14488a015f98a967f92
74 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0012

Heuristics 4

  • Cracked-software lure uses download-gateway redirectors high PDF_CRACKED_SOFTWARE_REDIRECTOR_LINK_FARM
    PDF contains multiple cracked-software/keygen/serial-key lure links together with long encoded download-gateway URLs or known crack-download redirector hosts. This is stronger than generic piracy vocabulary: the document is an SEO lure that funnels users through redirect/download infrastructure commonly used for adware, unwanted software, or droppers.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardlyfind.com/days].kingdom?/antillean/layoff/ZHluYWZvbnQgdHlwZW11c2V1bSA1NzAwIHRydWV0eXBlIGZvciB3aW5kb3dzIGRvd25sb2FkZHl/ZG93bmxvYWR8WEswZG5kbWNueDhNVFkyTWpZNE1ETTVNSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA/maximize PDF link annotation
    • https://purosautosdetroit.com/wp-content/uploads/2022/09/HD_Online_Player_Dosti_Friends_Forever_Hd_1080p_In_Hi.pdfIn PDF document text
    • https://shobeklobek.com/wise-registry-cleaner-pro-10-2-3683-torrent-2019-download-upd/In PDF document text
    • https://konnektion.com/advert/its-a-guy-thing-david-deida-ebook-download-__full__/In PDF document text
    • https://ebs.co.zw/advert/visual-web-ripper-3-0-19/In PDF document text
    • https://www.easydial.in/wp-content/uploads/2022/09/Wavemachine_Labs_Drumagog_Platinum_V511.pdfIn PDF document text
    • https://diontalent.nl/2022/09/11/o-destino-do-poseidon-dublado-download-fixed/In PDF document text
    • https://dottoriitaliani.it/ultime-notizie/rimedi-naturali/telecharger-windev-14-avec-crack-gratuit-top/In PDF document text
    • http://knowthycountry.com/?p=21113In PDF document text
    • http://www.landtitle.info/the-bhoothnath-returns-full-movie-download-kickass-torrent-top/In PDF document text
    • http://bariatric-club.net/?p=60879In PDF document text
    • http://spacebott.com/?p=35015In PDF document text
    • https://lifemyway.online/wp-content/uploads/2022/09/Native_Instruments__Session_Strings_Pro_KONTAKT_Serial_Key_k.pdfIn PDF document text
    • https://www.zmiksowane.com/wp-content/uploads/2022/09/Diablo_3_Offline_Crack_Skidrow_Download.pdfIn PDF document text
    • https://www.scoutgambia.org/bionicle-heroes-vitality-fixed-and-extracted-serial-key-link/In PDF document text
    • http://agrit.net/2022/09/download-ninja-gaiden-3-pc-full-version-verified/In PDF document text
    • https://floridachiropracticreport.com/advert/subulus-salam-terjemahan-pdf-63/In PDF document text
    • https://forallequal.com/crack-extra-quality-artcam-2015-free-download/In PDF document text
    • http://lovelyonadime.com/download-mss32-dll-with-ail-set-sample-volume8-download-8-portable/download-mss32-dll-with-ail-set-sample-volume8-download-8-portable/In PDF document text
    • http://leasevoordeel.be/wp-content/uploads/2022/09/HD_Online_Player_The_Walking_Dead_Season_4_720p_Blu.pdfIn PDF document text
    • https://www.lacalleloiza.com/wp-content/uploads/2022/09/erwlill.pdfIn PDF document text
    • http://hardlyfind.com/days].kingdom?/antillean/layoff/zhluywzvbnqgdhlwzw11c2v1bsa1nzawihrydwv0exbligzvcib3aw5kb3dzigrvd25sb2fkzhl/zg93bmxvywr8weswzg5kbwnuedhnvfkytwpzne1ettvnshg4twpvnu1iedhlrtbwsuzkdmntundjbvz6y3lcyldfmu1vbejesuzzeulgqkvsbda/maximizeIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16B3 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009e9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9E9F 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261