Malicious PDF — malware analysis report

Static analysis result for SHA-256 039963893c6a175a…

MALICIOUS

PDF

22.0 KB Created: 2020-05-17 21:17:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-08
MD5: 5d50fb7c484a7d8b80fe493dde196cbf SHA-1: ba88fb313a70d8924ac4f8ea0cde86f9881f56f8 SHA-256: 039963893c6a175ab771c754a115017b350bd647ef73ba4a11522e0cafb21ab6
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, suggesting a link farm or phishing attempt. The document body text, though partially corrupted, includes references to 'windows 7' and appears to be generated by wkhtmltopdf, indicating a potential lure for users seeking software or updates. The presence of many external PDF links points towards a strategy to redirect users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://94veinte.com/uploads/1/3/0/4/130491319/130491319.html#cd+siz+format+atma+windows+7 PDF link annotation
    • http://machineintelligencelab.org/uploads/1/3/1/4/131453171/2e154d.pdfIn PDF document text
    • http://scavengertours.com/uploads/1/3/0/2/130291624/1429867.pdfIn PDF document text
    • http://themedicalscienceeditor.net/uploads/1/3/0/3/130379173/tulasavivejij.pdfIn PDF document text
    • http://knoxypsummit.com/uploads/1/3/0/6/130639710/pujezeno.pdfIn PDF document text
    • http://allthingsballet.com/uploads/1/3/0/5/130539131/8578307.pdfIn PDF document text
    • http://mosaixcubed.com/uploads/1/3/1/0/131070646/sidab-juxiliz-defiraji-dasop.pdfIn PDF document text
    • http://happywaytrucking.com/uploads/1/3/1/4/131437476/fofedanolipojubax.pdfIn PDF document text
    • http://ienchantify.store/uploads/1/3/0/7/130776854/fotufoja.pdfIn PDF document text
    • http://drivenbrand.com/uploads/1/3/0/6/130621052/belegovagugero_duvifowodufa_xagoxatozufot.pdfIn PDF document text
    • http://visualimpactlandscaping.com/uploads/1/3/1/4/131454207/wapada-xofibexari-dojapi-fimez.pdfIn PDF document text
    • http://bierrecensies.nl/uploads/1/3/0/7/130776801/8937511.pdfIn PDF document text
    • http://rongchannel.com/uploads/1/3/1/4/131453682/javunamikafa.pdfIn PDF document text
    • http://platinumprosports.com/uploads/1/3/1/3/131380470/50ce8ab6fd2d5.pdfIn PDF document text
    • http://actionwipes.ca/uploads/1/3/0/4/130483114/2a60483e94.pdfIn PDF document text
    • http://annarosebongiovanni.com/uploads/1/3/0/7/130740191/ae81f5495.pdfIn PDF document text
    • http://hthmconsulting.com/uploads/1/3/0/4/130483457/jurifujexa.pdfIn PDF document text
    • http://goalus.org/uploads/1/3/0/3/130323403/9336265.pdfIn PDF document text
    • http://christophercorvo.com/uploads/1/3/0/6/130639291/vitorita.pdfIn PDF document text
    • http://silverribboncrafts.com/uploads/1/3/1/3/131381045/xedegobema.pdfIn PDF document text
    • http://beautifulyouartistry.net/uploads/1/3/1/0/131070753/1670758.pdfIn PDF document text
    • http://malenyretreat.com/uploads/1/3/0/5/130540477/kegobemiwisesefav.pdfIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.