Malicious PDF — malware analysis report

Static analysis result for SHA-256 f960654c16fb31f4…

MALICIOUS

PDF

126.8 KB Created: 2022-06-10 08:38:13 +02:00 Authoring application: tarebe (via PDF Master 1.0.1) First seen: 2026-06-03
MD5: bbd741e4e3800d67712cb017adb0b7c3 SHA-1: d41f474741261412677ceff13b4eb70b2f355759 SHA-256: f960654c16fb31f4989a2224ecf8f95b4c4025c8eae0603a814719d78a93cba4
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0206

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/aureus/ZG93bmxvYWR8Z2cyWkdOeGRIeDhNVFkxTkRjNE1EZzNPWHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/portugeezer.cmhpi/parentsofhairpullers/entrecote?TGVjdHJhIE1vZGFyaXMgTGljZW5zZSBGaWxlTGV PDF link annotation
    • https://richard-wagner-werkstatt.com/2022/06/10/adobe-illustrator-cs6-16-0-0-32-64-bit-with-serial-key-rar-top/In PDF document text
    • http://www.fuertebazar.com/2022/06/10/euro-truck-simulator-2-with-the-load-on-europe-3/In PDF document text
    • https://www.incubafric.com/wp-content/uploads/2022/06/Gta_San_Andreas_Ptmg_Edition_21_Ps2_Download_REPACK.pdfIn PDF document text
    • http://n0thingbutart.com/wp-content/uploads/2022/06/Berlitz_English_Level_3_Book_And_Audio.pdfIn PDF document text
    • http://yotop.ru/2022/06/10/labeljoy-5-1-0-build-104/In PDF document text
    • https://homeimproveinc.com/aidfile-recovery-software-3-5-3-0-software-keygen/In PDF document text
    • http://www.hva-concept.com/naam-shabana-full-movie-download-in-mp4-free/In PDF document text
    • https://frameofmindink.com/wp-content/uploads/2022/06/Seiyuu_Danshi_Free_Download_PC_Game.pdfIn PDF document text
    • https://www.locatii.md/wp-content/uploads/2022/06/Faronics_Deep_Freeze_Standard_8380204676_Patch.pdfIn PDF document text
    • http://www.buzzthat.org/wowonder/upload/files/2022/06/pYYAgUU6RzpxGYicIUvt_10_03171728840b67c90820fb2981979d02_file.pdfIn PDF document text
    • https://wanoengineeringsystems.com/max-payne-3-crack-indir-no-cd-dvd-hot/In PDF document text
    • https://affiliateschools.com/upload/files/2022/06/5aOOvbBbS7gK6eeSSvlb_10_03171728840b67c90820fb2981979d02_file.pdfIn PDF document text
    • https://www.ozcountrymile.com/advert/intuit-quickbooks-enterprise-solutions-14-0-crack-portable/In PDF document text
    • https://openld.de/wp-content/uploads/2022/06/The_Three_Stooges_Dual_Audio_720p_Mkv_Extra_Quality.pdfIn PDF document text
    • http://www.indepthnepal.com/wp-content/uploads/2022/06/girkelm.pdfIn PDF document text
    • https://blankbookingagency.com/wp-content/uploads/2022/06/gavroswa.pdfIn PDF document text
    • https://www.allegrosingapore.com/wp-content/uploads/2022/06/Manajemen_Proyek_Konstruksi_Wulfram_Ervianto_32pdf.pdfIn PDF document text
    • https://dokterapk.com/adobe-media-encoder-cc-2019-v13-0-1-12-patch-cracksmind-serial-key-keygen/In PDF document text
    • https://bikerhall.com/upload/files/2022/06/WUIWHMpinimGoaYBFcsm_10_3cad6ea63079ef9efd726f4553f41d03_file.pdfIn PDF document text
    • https://secureservercdn.net/160.153.138.105/7be.830.myftpupload.com/wp-content/uploads/2022/06/Shank_Pc_How_To_Change_Language_From_Russian.pdf?time=1654843044In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000168b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x168B 120372 bytes
SHA-256: a5ffce97f175f0cb49f5c726acf2e7d6a62d930143372b31050903b42f37f22c
font_01_sfnt_off0000c524.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC524 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54

Open this report in the interactive analyzer, or submit your own file for analysis.