PDF static analysis report

Static analysis result for SHA-256 f2f221b0a50a0c48…

SUSPICIOUS

PDF

240.1 KB Created: 2022-10-16 08:45:38 +00:00 Authoring application: bernkaf (via PDF Master 1.0.1) First seen: 2026-06-13
MD5: 3680c6d43d9a3adf2f8593cb3eedc39a SHA-1: a15f84cd3c981dfff45122cd2ef265cea571cceb SHA-256: f2f221b0a50a0c481cae033e0a243c66b080c0cdbe36cf770d796cd892cd2232
44 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0004

Heuristics 3

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xtraserp.com/intergranular.boulders?hardraada=mortgaged&ZG93bmxvYWR8ZEYxZDNkMWFueDhNVFkyTlRjek16ZzBNWHg4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA=lifeboats/tapies.UGVyamFuamlhbiBTZXdhIEtlZGFpIFBkZiBEb3dubG9hZGwUGV PDF link annotation
    • https://xtc-hair.com/hirens-bootcd-16-2-rebuild-all-in-one-bootable-cd-torrent/In PDF document text
    • https://progressivehealthcareindia.com/2022/10/16/oxford-english-for-careers-nursing-1-students-book-download-new/In PDF document text
    • http://guc.lt/?p=35466In PDF document text
    • https://72bid.com?password-protected=loginIn PDF document text
    • https://eqsport.biz/camtasia-studio-4-0-keygen-full-free-version/In PDF document text
    • https://firis.pl/armin-van-buuren-this-is-what-it-feels-like-mp3-320kbps-ashu007armin-van-buuren-this-is-what-i-updated/In PDF document text
    • http://www.casadanihotel.com/?p=28427In PDF document text
    • http://www.hacibektasdernegi.com/wp-content/uploads/citycardrivingproductkeyandserialnumber.pdfIn PDF document text
    • http://rootwordsmusic.com/2022/10/16/thechakdeindiapdffreedownload-new/In PDF document text
    • http://www.bayislistings.com/fsx-p3d-p3d2-boeing-737-200c-milviz-sp3-hack-tool-portable-2/In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text
🗂 Part of campaign: secureserver.net 1471 samples