Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0c779d993e941c2…

MALICIOUS

PDF

132.0 KB Created: 2022-07-05 09:07:02 +02:00 Authoring application: sanbmarr (via PDF Master 1.0.1) First seen: 2026-05-02
MD5: 842d4a1ab6916b658c2b0ca60860f5c1 SHA-1: 966426bcc7a223d548f53b800a643ba2a3a6bcc6 SHA-256: c0c779d993e941c2835693896c68189d89c86a69a06f931b795d7a9488b90511
124 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0073

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://urluss.com/2slrxo PDF link annotation
    • https://unboxguru.com/wp-content/uploads/2022/07/nekenik.pdfIn PDF document text
    • https://www.renegade-france.fr/wp-content/uploads/2022/07/Adobe_Photoshop_2022_Version_2302_Crack_With_Serial_Number_.pdfIn PDF document text
    • https://www.be-the-first.it/wp-content/uploads/2022/07/Adobe_Photoshop_2022_version_23.pdfIn PDF document text
    • https://mysterious-harbor-45249.herokuapp.com/emanboh.pdfIn PDF document text
    • https://fast-lake-65521.herokuapp.com/Adobe_Photoshop_2021_Version_225.pdfIn PDF document text
    • https://repixelgaming.com/wp-content/uploads/2022/07/Adobe_Photoshop_CS3.pdfIn PDF document text
    • https://weilerbrand.de/wp-content/uploads/2022/07/valofer.pdfIn PDF document text
    • https://www.casaspisosyterrenos.com/wp-content/uploads/2022/07/Photoshop_CC_2019_version_20.pdfIn PDF document text
    • https://infinite-forest-16901.herokuapp.com/hamgast.pdfIn PDF document text
    • https://firmateated.com/wp-content/uploads/2022/07/Photoshop_CS3_Keygen_Crack_Setup__For_Windows_Updated_2022.pdfIn PDF document text
    • https://nameless-wave-69422.herokuapp.com/Adobe_Photoshop_CC_2015_version_17.pdfIn PDF document text
    • https://afternoon-journey-43327.herokuapp.com/Photoshop_2022_Version_2311.pdfIn PDF document text
    • https://murmuring-oasis-04598.herokuapp.com/ottycae.pdfIn PDF document text
    • https://thegervaisstreetbridge.com/wp-content/uploads/2022/07/Photoshop_2021_Version_223_keygen_generator___Free_Download.pdfIn PDF document text
    • https://dubaiandmore.com/wp-content/uploads/2022/07/ululzym.pdfIn PDF document text
    • http://thingsforfitness.com/wp-content/uploads/2022/07/Adobe_Photoshop_2022_.pdfIn PDF document text
    • https://prestigemarketingpartners.com/wp-content/uploads/2022/07/Photoshop_2021_Version_2231.pdfIn PDF document text
    • https://quiet-cove-60222.herokuapp.com/Photoshop_2022_Version_2302.pdfIn PDF document text
    • https://www.netcolf.it/wp-content/uploads/2022/07/Adobe_Photoshop_2022_Version_2301_Crack_File_Only__Activator_X64.pdfIn PDF document text
    • https://stormy-springs-92488.herokuapp.com/lemavand.pdfIn PDF document text
    • https://jyopra.com/wp-content/uploads/2022/07/Adobe_Photoshop_2021_Version_2242_Key_Generator__With_Keygen_Free_MacWin_Updated_2022.pdfIn PDF document text
    • https://lypaparsspiruat.wixsite.com/jayberscamchond/post/photoshop-cc-2015-version-16-serial-number-freeIn PDF document text
    • https://sounungvatoc.wixsite.com/courdistloxa/post/photoshop-key-generator-for-windows-2022-newIn PDF document text
    • http://alcorcie.yolasite.com/resources/Photoshop-2021-Version-2210-Crack-Mega---PCWindows.pdfIn PDF document text
    • http://phopade.yolasite.com/resources/Photoshop-2022-Version-2311-Download-Latest-2022.pdfIn PDF document text
    • https://trello.com/c/vvWxyI0R/114-adobe-photoshop-2021-version-2200-free-downloadIn PDF document text
    • https://fanmadebuconla.wixsite.com/slanobexat/post/adobe-photoshop-2021-version-22-patch-full-version-32-64bitIn PDF document text
    • https://trello.com/c/vRB6wPc4/80-photoshop-2021-version-222-hack-patch-mac-win-updated-2022In PDF document text
    • https://trello.com/c/8u24Qkej/44-photoshop-2022-version-2341-crack-keygen-with-serial-number-license-key-free-download-2022-newIn PDF document text
    • https://lollij2000.wixsite.com/holdiasyli/post/adobe-photoshop-2022-version-23-0-1-keygen-crack-setup-patch-with-serial-key-updatedIn PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
    • http://alcorcie.yolasite.com/resources/photoshop-2021-version-2210-crack-mega---pcwindows.pdfIn PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ecb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2ECB 84572 bytes
SHA-256: 63431cc558035d6666d9fa877e11475aa9bfcf2086692a5585bf4ddde4305d0a
font_01_sfnt_off0000b6f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB6F1 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261