Malicious PDF — malware analysis report

Static analysis result for SHA-256 01e6988cee3a88d5…

MALICIOUS

PDF

74.7 KB Created: 2021-02-13 11:29:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 09bf13065c4eca68e40d211b17d2b182 SHA-1: a4d709f5965e83ff7b507804bebf7973e77d3fd3 SHA-256: 01e6988cee3a88d5b2d5efa9489314e8d3cefecfad97486ffe6f5239e45d179f
196 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file exhibits characteristics of a phishing lure, utilizing a link farm and SEO redirector to direct users to external resources. The presence of numerous external links, including one pointing to a redirector, suggests an attempt to distribute malicious content or phish for information. The ClamAV detection and ML classifier further support its malicious nature, indicating it is likely a trojan designed for phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=smith+%2526+roberson%2527s+business+law+16th+edition+pdf PDF link annotation
    • https://lepekogiba.weebly.com/uploads/1/3/1/6/131637498/b0254e2437bb.pdfIn PDF document text
    • https://ronabamipiboti.weebly.com/uploads/1/3/4/5/134598089/wozugakubigopiruj.pdfIn PDF document text
    • https://tejojapifofomo.weebly.com/uploads/1/3/4/3/134339563/kekajabomutuv_walikutixaril.pdfIn PDF document text
    • https://redobalopubijav.weebly.com/uploads/1/3/1/3/131380120/2780939.pdfIn PDF document text
    • https://doxavigefixo.weebly.com/uploads/1/3/5/3/135391607/7881662.pdfIn PDF document text
    • https://sisasava.weebly.com/uploads/1/3/0/7/130738988/8101285.pdfIn PDF document text
    • https://xibimitavidin.weebly.com/uploads/1/3/1/8/131871740/7863180.pdfIn PDF document text
    • https://zabojipenow.weebly.com/uploads/1/3/1/6/131636987/sulofokunobopiriz.pdfIn PDF document text
    • https://voxonevixes.weebly.com/uploads/1/3/4/3/134383310/8ce5bee159.pdfIn PDF document text
    • https://xaredoluvowa.weebly.com/uploads/1/3/1/8/131871785/7110513.pdfIn PDF document text
    • https://jopokiwajisi.weebly.com/uploads/1/3/4/1/134108554/safigisab.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pusori/26322721458.pdfIn PDF document text
    • https://s3.amazonaws.com/fajonubinomeder/free_cash_envelope_template.pdfIn PDF document text
    • https://s3.amazonaws.com/dugibabafod/apollo_munich_health_insurance_policy.pdfIn PDF document text
    • https://s3.amazonaws.com/sogovekevi/34044275901.pdfIn PDF document text
    • https://s3.amazonaws.com/fedure/manonumoxape.pdfIn PDF document text
    • https://s3.amazonaws.com/falufusu/alaska_airlines_information_technology.pdfIn PDF document text
    • https://s3.amazonaws.com/moduxanakuri/63546552504.pdfIn PDF document text
    • https://s3.amazonaws.com/mexesazaxasa/74011348156.pdfIn PDF document text
    • https://s3.amazonaws.com/dinisemowoge/66298226581.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA1B 4504 bytes
SHA-256: 593fbfcdbc8a0817044c66d047ec3cb5d6be8267f7e7e77d97e5c2ca18702d9b
font_01_sfnt_off0000f93e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF93E 10640 bytes
SHA-256: e3d8c0dfcdfa382f4d53458f6004512db022ceff2148001390e6ddab5736aff3

Open this report in the interactive analyzer, or submit your own file for analysis.