Malicious PDF — malware analysis report

Static analysis result for SHA-256 c07eccfb52742776…

MALICIOUS

PDF

124.2 KB Created: 2022-06-30 19:53:07 +02:00 Authoring application: yancceli (via PDF Master 1.0.1) First seen: 2026-06-05
MD5: a78d87930953dfd5a53380836be68813 SHA-1: 6ccfaef49130c6ad4a320f7604b3591283e4564e SHA-256: c07eccfb5274277622cdc2f345c9dc602c8c0245a157c87ce0449f46760813f9
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0018

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://siteslocate.com/teamworker.dumped.rehabilitaiton?&shemp=ZG93bmxvYWR8c3A1TW10dlpueDhNVFkxTmpZd05ESTNOSHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA&&UGhvdG9zaG9wIDIwMjEgKFZlcnNpb24gMjIuMC4xKQUGh=salehoo PDF link annotation
    • http://www.prokaivos.fi/wp-content/uploads/Photoshop_2022_Version_2301_Product_Key__X64_April2022.pdfIn PDF document text
    • https://praxis-heine.com/wp-content/uploads/2022/06/Photoshop_2021_Version_225_Activation___License_Key_Final_2022.pdfIn PDF document text
    • https://www.cameraitacina.com/en/system/files/webform/feedback/kalnair673.pdfIn PDF document text
    • https://oag.uz/en/adobe-photoshop-2021-version-22-1-1-activation-key/In PDF document text
    • https://confiseriegourmande.be/wp-content/uploads/2022/06/Adobe_Photoshop_2021_Version_224.pdfIn PDF document text
    • https://mmsshop.ro/wp-content/uploads/2022/06/Photoshop_CC.pdfIn PDF document text
    • https://www.tec.ac.cr/en/system/files/webform/adobe-photoshop-2021-version-2211.pdfIn PDF document text
    • https://stinger-live.s3.amazonaws.com/upload/files/2022/06/Q67VnxBBF2x9WyuBb4yt_30_fbaec138996ef33e89d50353cdf2136f_file.pdfIn PDF document text
    • https://coleccionohistorias.com/2022/06/30/photoshop-2022-version-23-free-download/In PDF document text
    • https://brandvani.com/2022/06/30/adobe-photoshop-cc-2018-crack-file-only-incl-product-key/In PDF document text
    • https://social.urgclub.com/upload/files/2022/06/LrukIJAZSxjkAVWYoSLh_30_fbaec138996ef33e89d50353cdf2136f_file.pdfIn PDF document text
    • https://npcfmc.com/photoshop-cc-2015-version-18-activation-key-pc-windows-final-2022/In PDF document text
    • https://cosplaygoals.com/upload/files/2022/06/5zm6sjZwbBTr5CvSNrOR_30_fbaec138996ef33e89d50353cdf2136f_file.pdfIn PDF document text
    • https://www.clic.com.my/advert/copier-machine-mpc-3503In PDF document text
    • http://yiyo.es/wp-content/uploads/2022/06/Photoshop_2021_Version_2243.pdfIn PDF document text
    • https://concourse-pharmacy.com/2022/06/30/photoshop-2022-version-23-jb-keygen-exe-free-license-key-pc-windows/In PDF document text
    • https://louistomlinsonfrance.com/wp-content/uploads/2022/06/savygerm.pdfIn PDF document text
    • https://mevoydecasa.es/photoshop-2021-version-22-4-1-serial-key-with-full-keygen-april-2022/In PDF document text
    • https://www.kekogram.com/upload/files/2022/06/R15j4vCb2LtCIirlezF7_30_dbf232c3b845e50200908b7f4b2ca831_file.pdfIn PDF document text
    • https://emealjobs.nttdata.com/pt-pt/system/files/webform/adobe-photoshop-cs3.pdfIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00001d04.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D04 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off0000cae7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCAE7 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.