Malicious PDF — malware analysis report

Static analysis result for SHA-256 08239446791c9da6…

MALICIOUS

PDF

85.9 KB Created: 2021-03-22 01:56:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 08ae429044516f060c828e49ed0444a7 SHA-1: a562606ec76898f32d152ba16a29927c0d616158 SHA-256: 08239446791c9da6334e27f166503da8a92a649bbb4315e63de448ba8a5a9c1f
136 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by ClamAV as a phishing trojan and a machine learning classifier indicated a high probability of maliciousness. It contains an embedded URL that redirects to a suspicious domain, likely for phishing purposes. The document body appears to be corrupted or obfuscated, but the heuristic firings strongly suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/strik?utm_term=what+price+stamp+for+large+letter PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4499329/normal_6044239606c1f.pdfIn PDF document text
    • http://xsafak.com/33003069072quzlo.pdfIn PDF document text
    • http://lnstagram-helping-centre.com/the_expanse_season_5_episode_6_summaryy8e3x.pdfIn PDF document text
    • https://s3.amazonaws.com/vaxebisapesi/nadikalalima.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384483/normal_603f43a6ed0cc.pdfIn PDF document text
    • https://s3.amazonaws.com/kovezux/what_should_i_wear_to_disney_in_february.pdfIn PDF document text
    • https://s3.amazonaws.com/kozibowisenatu/rccg_digging_deep_manual_2020.pdfIn PDF document text
    • http://bamefidev.mygamesonline.org/vortech_mp10wqd_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/rekawexuretowo/58637640841.pdfIn PDF document text
    • http://repair-foto.ru/15501003780jupp8.pdfIn PDF document text
    • https://s3.amazonaws.com/sirilagewuga/button_onclick_not_working_android.pdfIn PDF document text
    • https://s3.amazonaws.com/kelageketisefuv/elementary_the_price_of_admission_cast_imdb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451929/normal_6013c16b96750.pdfIn PDF document text
    • http://zobotalemogi.sportsontheweb.net/89627357705.pdfIn PDF document text
    • https://s3.amazonaws.com/kugelilizibuwum/73079307125.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/d3e440fa-984f-4da8-be84-6175015274c2/kitchenaid_superba_microwave_not_heating.pdfIn PDF document text
    • http://gitodake.myartsonline.com/philippine_calendar_2020_printable.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64d454d1-d995-4c1d-85a7-03e39927ec1b/hp_elitedesk_800_g1_sff_specs_i7.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/490047bd-14e9-480b-b363-c66d2692031c/canon_printer_mg3520_connect_to_wifi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0e1b057b-58e2-4b4f-93a2-2abbf50ea22e/62357627526.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000110e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110E9 5444 bytes
SHA-256: c5b4619f4780d371dab73fcab546c726728e94912629a240d6af5fb023e89163
font_01_sfnt_off00012351.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12351 11420 bytes
SHA-256: c5fcf5e46df7792ada5a918330efe94c5931b36e110c157703ab8a851a94d1fe

Open this report in the interactive analyzer, or submit your own file for analysis.