Malicious PDF — malware analysis report

Static analysis result for SHA-256 0be01648264e9745…

MALICIOUS

PDF

109.3 KB Created: 2020-11-23 14:10:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: ed99dd37b9e042c31e4aee43b86f9e3a SHA-1: d6aca0dbbb4e6ae1496176fee320cb556fe0917f SHA-256: 0be01648264e974534d5d82e9fc48ab092da76fc73274be2c8a7c56149eab8f4
212 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded links, with one identified as a known malicious redirector. The document body, though heavily obfuscated, suggests a lure related to 'Bosch appliance installation manuals'. The presence of numerous external PDF links, including one pointing to a malicious redirector, indicates a likely phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9348

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/strik?utm_term=bosch+appliance+installation+manuals In PDF document text
    • https://lokugejepotag.weebly.com/uploads/1/3/4/3/134318746/96b93abe5d.pdfIn PDF document text
    • https://zisogojevup.weebly.com/uploads/1/3/1/4/131453725/bubulutaxub.pdfIn PDF document text
    • https://jewiwepetaj.weebly.com/uploads/1/3/4/7/134752938/wivalipet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4b8c6c8d-6f72-4e2f-9f8c-fc6771d63517/crire_la_suite_d_une_histoire.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf6d79dd-31bf-42cd-88ca-d74b584a1d11/kebiwizoxavarejunupukexi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61d5a0ca-4c70-480f-b955-ef36c73395b2/piziwazafugejitagopuja.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7aba2cac-2158-45ad-bd07-f8e95b4020a8/limawusumeduxaxad.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/76f24b86-3222-4938-9514-c5ea647a7c6e/xidurane.pdfIn PDF document text
    • https://s3.amazonaws.com/nijosinizo/adenitis_cervical_en_nios.pdfIn PDF document text
    • https://s3.amazonaws.com/lomogas/bissell_little_green_machine_user_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9eec52b-7941-49ef-be72-2d8a56c912b1/jisofurumomeluz.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.