Malicious PDF — malware analysis report

Static analysis result for SHA-256 06e46fffc856d288…

MALICIOUS

PDF

76.3 KB Created: 2021-02-25 08:32:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 47a95254137d00ec4e6ed0a57eb267e7 SHA-1: 045eb106ca1ee5e9955716458d341f89cf435116 SHA-256: 06e46fffc856d2885fd3e0f27af93c865dad5db22722e4546628b514a0941181
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains heuristics indicating it is a phishing lure, specifically using an image to redirect users to a URL. The embedded URL and the document body text, though obfuscated, suggest a pretext related to obtaining a driver's license to trick users into clicking the malicious link. ClamAV detection further confirms its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8924

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://leonvi.ru/award?keyword=what+documents+are+needed+to+get+a+driver%2527s+license+in+arkansas PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4414173/normal_5fc5f510b0f65.pdfIn PDF document text
    • https://cdn.sqhk.co/fofotixoz/ie2Gjcb/renusonikokutilusu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473388/normal_602dd6ec172af.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4481540/normal_6012db4045877.pdfIn PDF document text
    • https://cdn.sqhk.co/wofetewa/ijia4y6/25479153428.pdfIn PDF document text
    • http://copalofa.site/52210476551qlfh4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368759/normal_60224ccc81af4.pdfIn PDF document text
    • https://cdn.sqhk.co/nowovadizeb/KC9HWhh/gmx_cloud_apk.pdfIn PDF document text
    • http://nagesebaz.iblogger.org/93632340161.pdfIn PDF document text
    • http://extrameets.fun/femifonarovivifofaju4r0fh.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://biwewoxowimin.rf.gd/wulixenevi.pdfIn PDF document text
    • https://s3.amazonaws.com/tidigudetefumof/fenaxivasoxovela.pdfIn PDF document text
    • https://s3.amazonaws.com/jijumupade/daily_expenses_excel_sheet_format.pdfIn PDF document text
    • http://mojedebebetum.epizy.com/messenger_lite_updated_app.pdfIn PDF document text
    • https://s3.amazonaws.com/toguvaju/number_format_php_without_comma.pdfIn PDF document text
    • https://s3.amazonaws.com/gaxuremewuger/cbo_full_form_in_tcs.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001163c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1163C 5524 bytes
SHA-256: a2e9484d3d9a655d8bb4523e50e051d978aa6ad7e6aa819d76d0b8b6af49108f

Open this report in the interactive analyzer, or submit your own file for analysis.