Malicious PDF — malware analysis report

Static analysis result for SHA-256 f968fc5ca512fb6e…

MALICIOUS

PDF

118.2 KB Created: 2022-07-28 22:20:01 +00:00 Authoring application: latcyr (via PDF Master 1.0.1) First seen: 2026-06-04
MD5: 4f3bccebb48d29c10b6a813d540a8bdc SHA-1: d0cb1212ba6a80d6239692128bb6698c75d85175 SHA-256: f968fc5ca512fb6ee3f4f31fb8867732afda829111ee0c311c9b88ffa7716c56
94 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0019

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link farm advertises cracked/pirated software medium PDF_CRACKED_SOFTWARE_LURE
    PDF contains many clickable links whose targets use cracked-software, keygen, serial-key, or warez vocabulary. These are SEO-spam lure documents that rank for software-piracy searches and route users to fake 'crack' download pages distributing potentially-unwanted programs, adware, or droppers. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lehmanbrotherbankruptcy.com/aphorism/filipinovegetarianrecipe/ZG93bmxvYWR8STRiZUhKcGJYeDhNVFkxT0RJeE9UUTNNM3g4TWpVNU1IeDhLRTBwSUZkdmNtUndjbVZ6Y3lCYldFMU1VbEJESUZZeUlGQkVSbDA.QmFuZGljYW0gMy4zLjAuMTE3NCBGdWxsIENyYWNrIExhdGVzdCBGcmVlIERvd25sb2FkQmF/carree=hetero=macs.trich.moss PDF link annotation
    • https://rwbible.com/gaby-espino-desnuda-y-cojiendo-link/In PDF document text
    • https://weilerbrand.de/wp-content/uploads/2022/07/Information_Systems_For_Managers_Piccoli_Pdf_Free_Download_HOT.pdfIn PDF document text
    • https://zurisdream.com/wp-content/uploads/2022/07/Intel_Indeo_Video_32_Codec_Downloadl.pdfIn PDF document text
    • http://www.oscarspub.ca/wp-content/uploads/2022/07/Photoprint10ripsoftwarecrackdownload_TOP.pdfIn PDF document text
    • http://festivaldelamor.org/?p=5073630In PDF document text
    • https://burewalaclassified.com/advert/active-killdisk-professional-suite-v7-1-12-with-key-tordigger-serial-key-keygen-portable/In PDF document text
    • http://iselinfamilylaw.com/sam-broadcaster-4-7-1-crack-exclusive-58/In PDF document text
    • https://socks-dicarlo.com/wp-content/uploads/2022/07/savelev.pdfIn PDF document text
    • http://maisonporteouverte.com/wp-content/uploads/2022/07/Shades_Of_Sin_Full_BEST_Episodes_In_English-1.pdfIn PDF document text
    • https://outdoormingle.com/wp-content/uploads/2022/07/honestechtvr30fulldownloadcrack.pdfIn PDF document text
    • https://clasificadostampa.com/advert/desarrollo-del-pensamiento-tomo-2-resuelto-pdf/In PDF document text
    • https://halalkitchenrun.com/wp-content/uploads/2022/07/Pro_Evolution_Soccer_2013_S3IEA4_NTSC_WIIWBFS_BETTER.pdfIn PDF document text
    • https://www.mjeeb.com/ali213-install-crack-wwe-2k15-pc/In PDF document text
    • http://www.cpakamal.com/sejong-tablet-compression-machine-pdf-33/In PDF document text
    • http://applebe.ru/2022/07/29/hp-nr146-motherboard-manual-pdf/In PDF document text
    • http://marido-caffe.ro/?p=13602In PDF document text
    • https://stepmomson.com/wp-content/uploads/2022/07/Free_Download_Electrical_Engineering_Fundamentals_By_Vincent_Del_Toro_Solutionzip_WORK.pdfIn PDF document text
    • https://www.cooks.am/wp-content/uploads/2022/07/okalale.pdfIn PDF document text
    • http://technorium.ma/wp-content/uploads/2022/07/Delphi20143keygenEXCLUSIVE_Download40.pdfIn PDF document text
    • https://omidsoltani.ir/272670/eva-ionesco-playboy-1976-italianrar.htmlIn PDF document text
    • https://weilerbrand.de/wp-content/uploads/2022/07/Information_SysIn PDF document text
    • https://zurisdream.com/wp-content/uploads/2022/07/Intel_Indeo_VidIn PDF document text
    • http://www.oscarspub.ca/wp-content/uploads/2022/07/Photoprint10rIn PDF document text
    • https://burewalaclassified.com/advert/active-killdisk-professional-In PDF document text
    • http://iselinfamilylaw.com/sam-broadcaster-4-7-1-crack-In PDF document text
    • http://maisonporteouverte.com/wp-content/uploads/2022/07/ShadesIn PDF document text
    • https://outdoormingle.com/wp-In PDF document text
    • https://clasificadostampa.com/advert/desarrollo-del-pensamiento-In PDF document text
    • https://halalkitchenrun.com/wp-content/uploads/2022/07/Pro_EvolutiIn PDF document text
    • http://www.cpakamal.com/sejong-tablet-compression-machine-In PDF document text
    • https://stepmomson.com/wp-content/uploads/2022/07/Free_DownloIn PDF document text
    • http://technorium.ma/wp-content/uploads/2022/07/Delphi20143keyIn PDF document text
    • https://omidsoltani.ir/272670/eva-ionesco-In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001631.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1631 84508 bytes
SHA-256: 2b7ba551bea82cc3307397981c1dbeb1b78486f95f2eb14e5e58d4e1b24edb0c
font_01_sfnt_off00009e1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9E1D 83036 bytes
SHA-256: 6d13e73e85a502a13969f6a5eaecd0b275a0868c045f80b7d64ed55d70678261