PDF static analysis report

Static analysis result for SHA-256 ff29d7bfcaa22f54…

SUSPICIOUS

PDF

265.7 KB Created: 2022-06-15 21:41:56 +02:00 Authoring application: elbqua (via PDF Master 1.0.1) First seen: 2026-05-13
MD5: 9016ea05a72902f3e2e37555d253c0a5 SHA-1: d60987c145337fd5fb6fc87fe4cb1715b2700e2f SHA-256: ff29d7bfcaa22f54592691a0a23c0f2df8632f1cc12d1e45e96e3faf7cbda967
44 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0104

Heuristics 3

  • PDF links to document on public blob storage high PDF_PUBLIC_BLOB_DOCUMENT_LINK
    PDF contains a clickable action to a document payload hosted on public blob/object storage. Shared object storage can be used legitimately, so this rule is suspicious rather than conclusive unless paired with lure text or other phishing indicators.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evacdir.com/hulks/unfit/cubby/dealing/R2lsaVNvZnQgU2VjdXJlIERpc2MgQ3JlYXRvcgR2l/kotite/ZG93bmxvYWR8VDRITmpReE9IeDhNVFkxTlRJNU9UZzBOSHg4TWpVM05IeDhLRTBwSUhKbFlXUXRZbXh2WnlCYlJtRnpkQ0JIUlU1ZA/pasteurization/runaway PDF link annotation
    • http://bleumartinionline.com/sipac-��������������-latest-2022.htmlIn PDF document text
    • https://inspirationhut.net/wp-content/uploads/2022/06/mikhdara.pdfIn PDF document text
    • http://www.b3llaphotographyblog.com/wp-content/uploads/2022/06/Game_Timer.pdfIn PDF document text
    • https://fluxlashbar.com/wp-content/uploads/2022/06/chrirayc.pdfIn PDF document text
    • https://entrepreneurlifecompliance.com/wp-content/uploads/2022/06/maloyela.pdfIn PDF document text
    • https://storage.googleapis.com/paloodles/upload/files/2022/06/1GpIzAPQyBINeGkavYac_15_0cafe4f5cd5b5f733801f15deaa4102e_file.pdfIn PDF document text
    • https://www.encremadas.com/wp-content/uploads/2022/06/FileWing_Shredder______3264bit.pdfIn PDF document text
    • https://www.tamtadinda.com/wp-content/uploads/2022/06/Slimm_Stopwatch.pdfIn PDF document text
    • https://sawkasetworld.net/upload/files/2022/06/i3o6K4qPXCT41mJDA5MI_15_d557600016add04da188076faa164d7b_file.pdfIn PDF document text
    • https://lamachodpa.com/wp-content/uploads/2022/06/Lazy_Roulette_Calculator.pdfIn PDF document text
    • https://marriagefox.com/qif2ofx-convert-��������-��������������-mac-win/In PDF document text
    • https://www.lbbskin.com/lbb-tribe/autorun-����������������������������-������������-������������-����������/In PDF document text
    • https://shravasti.fastnews24x7.com/advert/windows-updates-downloader-%d0%ba%d1%80%d1%8f%d0%ba-license-keygen-%d1%81%d0%ba%d0%b0%d1%87%d0%b0%d1%82%d1%8c-%d0%b1%d0%b5%d1%81%d0%bf%d0%bb%d0%b0%d1%82%d0%bd%d0%beIn PDF document text
    • http://titfortech.com/?p=29770In PDF document text
    • https://aceon.world/timeline-maker-professional-��������������-������������������-������-������������������/In PDF document text
    • https://sharevita.com/upload/files/2022/06/dJMNbznUCekhJ5B7E5wi_15_1c68ae8ef8043de226df1b02926f5d04_file.pdfIn PDF document text
    • https://acaciasports.com/wp-content/uploads/2022/06/Open_Tabs.pdfIn PDF document text
    • https://unmown.com/upload/files/2022/06/EhoInvP6jaG7FSIAiQxe_15_1c68ae8ef8043de226df1b02926f5d04_file.pdfIn PDF document text
    • https://rko-broker.ru/2022/06/15/any-media-player-license-key-full-��������������-������������������-������-����������������/In PDF document text
    • https://contthelquarisec.wixsite.com/mettbugtvanga/post/zerospyware-patch-with-serial-key-��������������In PDF document text
    • http://www.tcpdf.orgIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.aiim.org/pdfa/ns/extension/In PDF document text
    • http://www.aiim.org/pdfa/ns/schema#In PDF document text
    • http://www.aiim.org/pdfa/ns/property#In PDF document text
    • http://www.aiim.org/pdfa/ns/id/In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00001c31.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C31 128384 bytes
SHA-256: 11de14530b7e0d157d587b9f485e3940191c6c81dde66b52872b0f60f4dd3df9
font_01_sfnt_off0000dc70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDC70 78908 bytes
SHA-256: 15b896353e16399e8b9eecbb376ea5953bb7fa7edfe908ee264b6525c286d8f8