PDF static analysis report

Static analysis result for SHA-256 f945f1d0e7cf614e…

SUSPICIOUS

PDF

48.2 KB Created: 2022-12-17 15:09:33 +00:00 Authoring application: hesiran (via mPDF 8.1.2) First seen: 2024-01-03
MD5: 832669d35dda7b709077ade38a8767bf SHA-1: cd6df8ec53ae4f327953a7a36467cbe3744f8770 SHA-256: f945f1d0e7cf614e868e181ce0d6a1b2f839b5be63af757a6f8d8a44e23699f4
44 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0013

Heuristics 3

  • PDF links to a cracked-software download doorway (base64-obfuscated) high PDF_CRACKED_SOFTWARE_DOWNLOAD_DOORWAY
    PDF's embedded link hides a pirated-software title as a base64 blob inside the URL path/query (and/or carries the ``download|`` doorway-template marker), rather than in visible text. This is a TCPDF-generated SEO doorway that ranks for software-piracy searches and funnels users to fake 'crack/keygen' download pages distributing adware, potentially-unwanted programs, or droppers. The base64 encoding is deliberate obfuscation to evade plaintext lure rules; the PDF itself carries no parser exploit — the risk is the linked crack-download destination.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardlyfind.com/bonfim.programme?...&ZG93bmxvYWR8Y2cxTVc5NGFYeDhNVFkzTVRJMk5qRTVOM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA=proprioceptor&coverstocks=RGlzY3JldGUgVGltZSBDb250cm9sIFN5c3RlbXMgT2dhdGEgUGRmIEZyZWUgRG93bmxvYWRkY2luc3RsRGl PDF link annotation
    • https://www.actsmiami.com/wp-content/uploads/2022/12/SHAREit_5168_.pdfIn PDF document text
    • https://www.digitalgreenwich.com/hezekiah-walker-second-chance-free-mp3-download-__link__/In PDF document text
    • https://beznaem.net/wp-content/uploads/2022/12/Kamasutra-Tamil-Ebook-Free-Download-Pdfgolkes-LINK.pdfIn PDF document text
    • https://immanuelglobalwp.com/teensmart-driving-certification-test-answers-link/In PDF document text
    • https://propcurrency.org/wp-content/uploads/2022/12/Vray-20-Rhino-5-NEW-Crackl.pdfIn PDF document text
    • https://beznaem.net/wp-content/uploads/2022/12/Kamasutra-Tamil-Ebook-Free-Download-Pdfgolkes-In PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_02_sfnt_off00008bb5.bin)
    • http://dejavu.sourceforge.netIn extracted file (stream_004_off000023e6.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_004_off000023e6.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_02_sfnt_off00008bb5.bin)
🗂 Part of campaign: secureserver.net 1471 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000023e6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x23E6 19824 bytes
SHA-256: b5a056ebcfa63b81c85d4fd1ac3bc6fe76845c50664add9735242967184c2e9d
font_01_sfnt_off000057b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x57B5 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00008bb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BB5 26892 bytes
SHA-256: 440ba7b1b0fb2eb971275b07a98648fad327a18a6221b47420b3d824bf3a407a

Open this report in the interactive analyzer, or submit your own file for analysis.