Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff6e61bc03022d31…

MALICIOUS

PDF

111.6 KB Created: 2026-04-19 11:03:35 +09:00 Authoring application: Aspose Ltd. (via Aspose.PDF for .NET 21.8.0) First seen: 2026-04-23
MD5: 096b883c0fd3963864e52092120d1b09 SHA-1: 40f54d0342ec030c4ca21304542020c4211a27f2 SHA-256: ff6e61bc03022d318d04676857a21db7b8c17e276d868ad26c0c4038e6dde712
62 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://noorfana.com/wp-content/uploads/2022/06/janalbe.pdf In PDF document text
    • https://netgork.com/upload/files/2022/06/ZiMnKUCGrprDHpbmhwoO_10_3f3f4cb33b3839c98161defa3618c223_file.pdfIn PDF document text
    • https://marriagecermony.com/iec-60439-2-pdf-free-download/In PDF document text
    • https://eurasianhub.com/wp-content/uploads/2022/06/Assassins_Creed_III__PC_Game_Trainer__Cheat_Code_Execution.pdfIn PDF document text
    • https://sc-designgroup.com/wp-content/uploads/2022/06/darr_1993_hindi_720p_br_rip_movie_torrents.pdfIn PDF document text
    • http://purosautoskansas.com/?p=34586In PDF document text
    • http://feelingshy.com/knuckle-pine-boxing-dash-pc-hot/In PDF document text
    • https://eqlidi.ir/wp-content/uploads/2022/06/Simul8_Download_Free_LINK_Crack_Softw.pdfIn PDF document text
    • http://visitingplan.com/wp-content/uploads/2022/06/krisdar.pdfIn PDF document text
    • https://www.onk-group.com/quick-heal-total-security-crack-2020-product-key-torrent-better/In PDF document text
    • https://autocracymachinery.com/fsx-paulo-ricardo-fsx-mega-rio-de-janeiro-2012-x-rip-hack-tool-download-portable/In PDF document text
    • http://veterinarybuyersgroup.com.au/sosiolinguistik-abdul-chaer-pdf-download-best-2/In PDF document text
    • http://okinawahousingportal.com/?p=22910In PDF document text
    • https://thebakersavenue.com/wp-content/uploads/2022/06/Sony_Ericsson_W150i_Flash_File_Zip.pdfIn PDF document text
    • https://deeprooted.life/wp-content/uploads/2022/06/yoshelis.pdfIn PDF document text
    • https://roandsport.com/wp-content/uploads/2022/06/Download_Wondershare_Data_Recovery_60031__Crack_Torrent.pdfIn PDF document text
    • https://followgrown.com/upload/files/2022/06/lQaMK74QO23IDFGJEGcj_10_3f3f4cb33b3839c98161defa3618c223_file.pdfIn PDF document text
    • https://innovacioncosmetica.com/reclaime-file-recovery-ultimate-crack/In PDF document text
    • https://kiralikofis.com/wp-content/uploads/2022/06/chayva.pdfIn PDF document text
    • https://tbone.fi/wp-content/uploads/2022/06/darrdami.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00001d69.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D69 120140 bytes
SHA-256: a217f12862e0ff75203bdd4136ca0d68471050be46bb09aed5306898926ffdd4
font_01_sfnt_off00010943.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10943 76772 bytes
SHA-256: 07ce6fea3c98bf59133021be55ce9147f9c26365efe580a2a4f82130ca697f54