Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a8996b96c72ac07…

MALICIOUS

PDF

127.9 KB Created: 2021-03-28 15:51:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: daf1a0f8cef85a11c64c35211ec9ea81 SHA-1: bd39ba2cbbe0d96b6ad8c39b07873a581396d1ff SHA-256: 0a8996b96c72ac07f43cfbf791ab84d40abf3b3841e767433330757b8e122c29
216 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains numerous external links, many pointing to SEO-optimized PDF farms, suggesting a phishing or malware distribution scheme. The presence of a critical heuristic firing for PDF_SEO_LINK_FARM and ClamAV detection of Pdf.Phishing.Trojan indicates malicious intent. The embedded URL and the document's structure strongly suggest a lure for users seeking device unlock tools, likely leading to a phishing page or a malicious download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9734

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/wix?keyword=device+unlock+t+mobile+apk+hack PDF link annotation
    • https://virixodebusetij.weebly.com/uploads/1/3/1/3/131383575/dewexifukozazavinuda.pdfIn PDF document text
    • http://tawaguf.scienceontheweb.net/zoology_textbook_class_12.pdfIn PDF document text
    • https://s3.amazonaws.com/rodiligarexo/fb_video_iphone_app.pdfIn PDF document text
    • https://runumoviw.weebly.com/uploads/1/3/4/8/134854062/tonuwid-vesaxe-golejebu.pdfIn PDF document text
    • https://s3.amazonaws.com/xarojapi/8503709395.pdfIn PDF document text
    • https://s3.amazonaws.com/fatisake/81912582762.pdfIn PDF document text
    • https://s3.amazonaws.com/pafiganovavi/61912785581.pdfIn PDF document text
    • https://cdn.sqhk.co/baxijaxazixi/hdqogdx/httyd_school_of_dragons_wiki.pdfIn PDF document text
    • https://bopovajo.weebly.com/uploads/1/3/5/9/135966354/kobujuvetesig.pdfIn PDF document text
    • https://s3.amazonaws.com/remuv/what_is_health_data_analytics.pdfIn PDF document text
    • http://pofaduxiruk.getenjoyment.net/melalanusubesomowu.pdfIn PDF document text
    • https://zubikuzo.weebly.com/uploads/1/3/1/4/131453486/4737904.pdfIn PDF document text
    • http://rogijowop.sportsontheweb.net/pdf_to_word_converter_software_crack.pdfIn PDF document text
    • https://s3.amazonaws.com/nutanigonu/kane_and_abel_book_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jepinebawo/5559214446.pdfIn PDF document text
    • https://wewopamutufufo.weebly.com/uploads/1/3/1/3/131398135/jepare.pdfIn PDF document text
    • http://bcpzon4segurabetaviabcp.com/famamefewotuzigam2ll3t.pdfIn PDF document text
    • https://cdn.sqhk.co/napumefu/Yejihfc/91433352849.pdfIn PDF document text
    • http://tradestaroffice.com/478288578428womo.pdfIn PDF document text
    • http://zixaxagewan.mypressonline.com/how_to_connect_bluetooth_on_pioneer_mixtrax.pdfIn PDF document text
    • http://autoupgrade.website/lirik_lagu_cant_stop_the_feeling_trollss3rsz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://gutekuretejapoj.onlinewebshop.net/adobe_acrobat_editor_full_version.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_008_off0001c3d7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C3D7 19104 bytes
SHA-256: ec8fe0305d69899ed399eb20f976486fd8639e66dc7ea077e9aa9e8261128f9e
font_00_sfnt_off00014a08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14A08 5916 bytes
SHA-256: 051dc5fe143f6c9acd007ea2e90313426e3aa12d0cc5e1b6455b772e7b0605e6
font_01_sfnt_off00015ea2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15EA2 5160 bytes
SHA-256: eec245d535494e4c3848208f48fa54c7dabc2feb05c19fee071aa141c3d1cf18
font_02_sfnt_off00017011.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17011 5700 bytes
SHA-256: 42e9ba47cafc691c79794d811ecf32f2c9e5a0a373a875a65cd1db7ea34fe67c
font_03_sfnt_off00018168.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18168 6148 bytes
SHA-256: 0b38f6fd5e0b54bfa22d5adee1cfe00629fe134100fc7cfc1ad14a2ab7974207
font_04_sfnt_off00019148.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19148 16788 bytes
SHA-256: 7b1c2a876b5bf42823f5ad8d9a7288a9736a7213cd58dd9794f456d48ca88e67
font_06_sfnt_off0001e306.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E306 3248 bytes
SHA-256: 375a32f4b5a630d2093d2c162e5e2a12043542d6d52cecc5c311a82ce68b3ef9

Open this report in the interactive analyzer, or submit your own file for analysis.