Malicious PDF — malware analysis report

Static analysis result for SHA-256 07c1bb1d6a58b8af…

MALICIOUS

PDF

87.3 KB Created: 2021-03-17 21:23:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 6cacf7f0e71d3863b3a474e3e3161a30 SHA-1: 940b4044d0eaa0bcd3a947127ee27c81b130b374 SHA-256: 07c1bb1d6a58b8af6b645d2d6c10ce8a977ceea38ee59e1be606f57060b4f1c1
64 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV with a Pdf.Phishing.Trojan signature. It contains an embedded URI pointing to a suspicious domain, pelibifir.ru, which is likely part of a phishing campaign. The document body, though heavily obfuscated, suggests a lure related to a 'blouse cutting and stitching book pdf' to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3988

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pelibifir.ru/award?keyword=blouse+cutting+and+stitching+book+pdf PDF link annotation
    • https://s3.amazonaws.com/babuxufarizuxur/74553520990.pdfIn PDF document text
    • http://kinoogf.space/93708321000ssayx.pdfIn PDF document text
    • http://promooffer.site/nordictrack_a2105_for_sale8jrvt.pdfIn PDF document text
    • http://feyakast.online/93767338815vd3pg.pdfIn PDF document text
    • https://s3.amazonaws.com/rolefosiju/6440420240.pdfIn PDF document text
    • https://cdn.sqhk.co/wimedizi/gfjhN0S/blue_apron_coupon_for_existing_customer.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422180/normal_600fd63d88c87.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4385204/normal_604a13312d8a3.pdfIn PDF document text
    • http://axecheat1.xyz/16664894224ukpcj.pdfIn PDF document text
    • https://s3.amazonaws.com/wekibik/nevasowitozamevitoxo.pdfIn PDF document text
    • https://s3.amazonaws.com/domegagowevag/40565310376.pdfIn PDF document text
    • https://cdn.sqhk.co/kutogudofi/jeiegcJ/color_electrical_tape_home_depot.pdfIn PDF document text
    • http://songkfrk.site/lifijanenofiruogvt4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4465688/normal_602fad434e929.pdfIn PDF document text
    • https://s3.amazonaws.com/gezejoputiwinu/sevefut.pdfIn PDF document text
    • https://s3.amazonaws.com/lekelepowo/are_self_closing_doors_required_on_flammable_cabinets.pdfIn PDF document text
    • http://wrinklestiltskin.com/dozilh265g.pdfIn PDF document text
    • http://andyhong.blog/air_jet_fighter_moviesuepz6.pdfIn PDF document text
    • http://myfoxing.online/onaroo_teach_me_time_talking_alarm_clock_sleep_trainer_and_nightlight5hhai.pdfIn PDF document text
    • http://lifeit.pro/mebaludubofogonigufotcvxm.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.indictrans.orgIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d4f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD4F9 5572 bytes
SHA-256: 751438b723427c5ed7f5ec2b2015b99a8a65b64d2796f1936b7b4ad048d81359
font_01_sfnt_off0000e7f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7F0 2656 bytes
SHA-256: dbaab8dcf32bfe64cb008f34eb54f5316f62236e8dffe3de49b44225404383a5
font_02_sfnt_off0000f2f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2F4 2328 bytes
SHA-256: 864cbe2c6973b44d2b71e19ffbffb2328dcb3759b07ceb43c11d5a372fc4956d
font_03_sfnt_off0000fdaa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDAA 2036 bytes
SHA-256: 00a945237f6b864b00fbf81283986f0fe986bd9b0d29dbf22e41200b3b742ffc
font_04_sfnt_off0001077d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1077D 4336 bytes
SHA-256: 87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284
font_05_sfnt_off0001151e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1151E 12652 bytes
SHA-256: 158e744ca60a336c29f191679846de55f09b1a565af0f1376ea87daab3625c05
font_06_sfnt_off00013fa4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13FA4 16364 bytes
SHA-256: 560548190d3588af37ebd144b10067da26eafb353cf82387b3a26894bc5052bc

Open this report in the interactive analyzer, or submit your own file for analysis.