Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c0c5fd562fba73b…

MALICIOUS

PDF

67.6 KB Created: 2021-02-15 06:14:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: b0c4843d705b060aa67fcdf48ef396e9 SHA-1: 3e69b1f731651abe06fea81af71b446f4f394f0e SHA-256: 0c0c5fd562fba73be8df55b3058aecff0047b61882323b52159ad6a4c906388a
122 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with at least one identified as a malicious redirector. The document body, though heavily obfuscated, appears to be a lure related to 'Osfi icaap template'. The presence of many links on disposable hosting further suggests a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6982

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/aws?utm_term=osfi+icaap+template In PDF document text
    • https://cdn-cms.f-static.net/uploads/4379837/normal_6010c5aef2dd4.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444357/normal_5fccd56d3cdeb.pdfIn PDF document text
    • http://sotaredojowiba.iblogger.org/wuzubipelalininaworegozo.pdfIn PDF document text
    • https://kepigepejabuji.weebly.com/uploads/1/3/4/3/134315220/2799552.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475000/normal_601f109f0fd36.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4487186/normal_5ff8681187293.pdfIn PDF document text
    • https://kekisuganuzab.weebly.com/uploads/1/3/4/7/134721312/85865cdd5ee0e7.pdfIn PDF document text
    • https://zikemuwebiwolim.weebly.com/uploads/1/3/5/9/135992964/5953142.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4370989/normal_5fcd75e2a42a1.pdfIn PDF document text
    • http://gijofabenetawix.66ghz.com/83214702219.pdfIn PDF document text
    • https://peliretoru.weebly.com/uploads/1/3/3/9/133997281/73719a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4445745/normal_6027310000259.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369905/normal_60245a25d1a25.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374360/normal_6013bff9c3d9e.pdfIn PDF document text
    • http://vitafunajubala.rf.gd/8288181631.pdfIn PDF document text
    • http://taxowojo.epizy.com/kizetegabulegub.pdfIn PDF document text
    • http://lojetewope.epizy.com/86193539058.pdfIn PDF document text
    • http://vobuluga.rf.gd/crying_cat_gif.pdfIn PDF document text
    • http://jogulele.epizy.com/5e_ranger_gloom_stalker_guide.pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.