PDF static analysis report

Static analysis result for SHA-256 efc54ea053ce9a2e…

SUSPICIOUS

PDF

55.3 KB Created: 2022-12-13 03:00:45 +00:00 Authoring application: tanijami (via mPDF 8.1.2) First seen: 2026-06-22
MD5: 6918914a28210bb4997570bf5c90bcd4 SHA-1: bd9a2e4e965858b0762bde234ffc9e09e49a1030 SHA-256: efc54ea053ce9a2eff752a8201f45718d915ea90ba02d145089da0e1a4e23244
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0043

Heuristics 3

  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://godsearchs.com/capacitance.carabiner.decorists.oregonian.ZG93bmxvYWR8Y2g3WkRnNU9IeDhNVFkzTURnek5ETXdPWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.recruiter.suthep.meditations...Q2FwdGlvbml6ZQQ2F PDF link annotation
    • https://joyme.io/pasdicwimtoIn PDF document text
    • https://joyme.io/quecuwbelmeIn PDF document text
    • https://islandcremations.com/wp-content/uploads/2022/12/hestaobr.pdfIn PDF document text
    • https://userapk.net/wp-content/uploads/2022/12/OutputChanger.pdfIn PDF document text
    • http://amlakzamanzadeh.com/wp-content/uploads/2022/12/aretkala.pdfIn PDF document text
    • https://onemorelure.com/wp-content/uploads/2022/12/Menu98.pdfIn PDF document text
    • https://www.powertribecommunity.com/blogs/latubo/rz_vcard-crack-free-2022/In PDF document text
    • https://assetdefenseteam.com/wp-content/uploads/2022/12/gregmore.pdfIn PDF document text
    • https://www.planetneurodivergent.com/wp-content/uploads/2022/12/SubsHub.pdfIn PDF document text
    • http://www.dblxxposure.com/wp-content/uploads/2022/12/Reminder-Commander-Crack-Updated.pdfIn PDF document text
    • https://tidmodell.no/wp-content/uploads/2022/12/XMyPaint.pdfIn PDF document text
    • https://americanzorro.com/cute-trader-crack-product-key-full-free-download-pc-windows-latest/In PDF document text
    • http://www.dblxxposure.com/wp-content/uploads/2022/12/reminder-commander-crack-updated.pdfIn PDF document text
    • http://dejavu.sourceforge.netFontsIn PDF document text
    • https://techplanet.today/post/non-destructive-testing-techniques-by-ravi-prakash-pdf-extra-quality-downloadIn PDF document text
    • https://techplanet.today/post/atozed-software-intraweb-ultimate-1425-newIn PDF document text
    • https://techplanet.today/post/3d-ultra-minigolfmulti5-crack-demo-freeIn PDF document text
    • https://techplanet.today/post/negative-muzica-populara-download-verified-gratisIn PDF document text
    • https://techplanet.today/post/sherry-13-gma3150-32bit-fix27z-happy-1701-olimpiad-repackIn PDF document text
    • https://techplanet.today/post/winrar-562-final-incl-updated-crack-64-bitIn PDF document text
    • https://reallygoodemails.com/juliogratwoIn PDF document text
    • https://reallygoodemails.com/cotestinkoIn PDF document text
    • https://techplanet.today/post/tomb-raider-2013-nude-mod-zip-hit-fullIn PDF document text
    • https://new.c.mi.com/my/post/651355/ADPTR_Audio_MetricAB_110In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn PDF document text
🗂 Part of campaign: secureserver.net 1471 samples

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004169.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4169 19824 bytes
SHA-256: 1007b9c0d29cc5a5933239e4adf9ccb29bdb5162302804c4f70c80d630bfaf41
font_01_sfnt_off0000753d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x753D 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off0000a928.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA928 25940 bytes
SHA-256: accd7776898fd5b9e7075d8bd5c42358b036de590cfc60c4479ec5074f77f6f1