Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea9aef6b754d69b3…

MALICIOUS

PDF

24.9 KB Created: 2023-01-20 00:46:36 +01:00 Authoring application: 376377000p000a000l000g000r000a000h (via GPL Ghostscript 9.55.0) First seen: 2026-04-13
MD5: dafbe6effdfaab5a34d2e5f763fb6640 SHA-1: 1c5949dcb37fdf03ea994591f7c7c0fe5852db4e SHA-256: ea9aef6b754d69b344d75ec408d9273c57c0e38440c9d3fa4b24af487efb0674
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0394

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://urllie.com/2sCSPP PDF link annotation
    • https://standoutfitness.com/wp-content/uploads/2023/01/Callanmethodstage12pdfdownload.pdfIn PDF document text
    • https://fonentry.com/wp-content/uploads/2023/01/janicast.pdfIn PDF document text
    • https://porizko.de/enid-blyton-collection-epub-to-mobi/In PDF document text
    • https://imarsorgula.com/wp-content/uploads/2023/01/Faceniff-An-Evil-Android-Application.pdfIn PDF document text
    • https://thenetworkcircle.com/wp-content/uploads/2023/01/Facebook_6_Haneli_Onay_Kodu_Hack.pdfIn PDF document text
    • https://208whoisgreat.com/wp-content/uploads/2023/01/makialto.pdfIn PDF document text
    • https://swisshtechnologies.com/eboostr-4-5-pro-full-patched-crack-17/In PDF document text
    • https://psychomotorsports.com/wp-content/uploads/2023/01/435ed7e9f07f7-210.pdfIn PDF document text
    • https://chichiama.net/code-lyoko-girls-naked/In PDF document text
    • https://womss.com/dialog-naskah-drama-timun-emas-dalam-bahasa-jawa-50cent-covert-achkayn-pack1-work/In PDF document text
    • http://quitoscana.it/2023/01/14/pes-2010-editor-v2-become-legend-download-best/In PDF document text
    • http://pacificgoods.net/wp-content/uploads/2023/01/manngaba.pdfIn PDF document text
    • https://www.creativeheart-travel.com/no-country-for-old-men-2007-brrip-x264-dualaudio-enghindi-375mbcool-guy-a2zrg/In PDF document text
    • https://magic-lamps.com/wp-content/uploads/2023/01/Shakalaka_Boom_Boom_In_Tamil_Download_Movie.pdfIn PDF document text
    • https://groottravel.com/uncategorized/personal-finances-pro-4-5-portable-rar-crack-serial-keygen-cd-key-rar-hot/In PDF document text
    • https://www.unitedartistsofdetroit.org/wp-content/uploads/2023/01/Claasmercator75instrukcjapdfdownload.pdfIn PDF document text
    • https://www.impactunlimited.co.za/advert/bolangir-college-student-sex-scandal-link-2/In PDF document text
    • https://maisonchaudiere.com/advert/mujhse-dosti-karoge-full-movie-free-download-avigolkes/In PDF document text
    • https://powerzongroup.com/2023/01/14/adobe-after-effects-2017-for-mac-os-x-sierra-hackcrack-free-download-100-working-macosx/In PDF document text
    • https://hazeandmore.nl/wp-content/uploads/2023/01/Matawi-Ya-Juu-Langa-Download-LINK.pdfIn PDF document text
    • https://womss.com/dialog-naskah-drama-timun-emas-dalam-bahasa-jawa-50cent-covert-achkayn-packIn PDF document text
    • https://www.creativeheart-travel.com/no-country-for-old-men-2007-brrip-x264-dualaudio-enghindi-37In PDF document text
    • https://magic-lamps.com/wp-content/uploads/2023/01/Shakalaka_Boom_Boom_In_Tamil_Download_In PDF document text
    • https://groottravel.com/uncategorized/personal-finances-pro-4-5-portable-rar-crack-serial-keygen-cd-In PDF document text
    • https://www.unitedartistsofdetroit.org/wp-content/uploads/2023/01/Claasmercator75instrukcjapdfdoIn PDF document text
    • https://powerzongroup.com/2023/01/14/adobe-after-effects-2017-for-mac-os-x-sierra-hackcrack-free-In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003301.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3301 4260 bytes
SHA-256: bd7d0abdec6cf70fc240445f77298a5d420e86f36339ed4a7abe2b8e176dbdca
font_01_sfnt_off00003f5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F5A 8868 bytes
SHA-256: 40e65fd1c351880ae7ee88bffff997253e4f2253b4e5b9c939b7c925cbb939d3