Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cda5a256f102f95…

MALICIOUS

PDF

72.6 KB Created: 2021-03-05 04:50:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: f0744ad94e38980526911e5af7d45632 SHA-1: fd499c89bf710b7713c2e90a8ffda30729a0955a SHA-256: 0cda5a256f102f95cf9ee7a33d753702e3b508a39d17e4af4e7e991e7c6451b1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL pointing to a suspicious domain, likely intended to trick the user into visiting a malicious site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan. The document body, though heavily obfuscated, contains keywords related to the URL, suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/wix?keyword=who+says+always+in+harry+potter PDF link annotation
    • http://se-mrush.com/jutadilonixavedasiwosemoqi011.pdfIn PDF document text
    • http://20970907.net/kerudogebasatuvexa4a4zh.pdfIn PDF document text
    • http://shtangennstutkupitseychas.xyz/furovavapirawewuxitamdd0c8.pdfIn PDF document text
    • http://vekifurusib.22web.org/human_genetics_interpreting_pedigrees_worksheet_answers.pdfIn PDF document text
    • http://pagebake.com/sustainable_living_guide_austin_tx4xead.pdfIn PDF document text
    • http://dfds.in/math_problems_for_third_gradersihokw.pdfIn PDF document text
    • http://politach.com/2020_turkce_pop_mp3_indir70ned.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://933afb0c-60ca-4ff4-ba38-e7c804ca925d.filesusr.com/ugd/941881_44e586c9d8bd4e5dae53dc13d60d1eb0.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pegebunov/77680814209.pdfIn PDF document text
    • https://s3.amazonaws.com/wajufifenoxuj/sherlock_holmes_crimes_and_punishments_trophy_guide.pdfIn PDF document text
    • http://fewuzefar.rf.gd/the_room_audience_participation_guide.pdfIn PDF document text
    • http://bepinutarefe.rf.gd/kalnirnay_calendar_july_2019.pdfIn PDF document text
    • https://s3.amazonaws.com/kikunojulejuj/tilidojapizalosozi.pdfIn PDF document text
    • https://34e2f0dc-0077-42bd-a047-efa2502e92af.filesusr.com/ugd/8a05ec_b290fc0ee8b04f2b982f4c8c31564a32.pdf?index=trueIn PDF document text
    • http://romusamepoma.epizy.com/download_audio_bacaan_alquran_30_juz.pdfIn PDF document text
    • https://86908e24-11f3-43a1-9346-bf531f45ee0b.filesusr.com/ugd/97493d_e0498c53860747738ad9404acf426f8b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zoluwivebiro/9994387718.pdfIn PDF document text
    • https://ce83042b-5faf-46b5-bcbb-9b4d05ec7d33.filesusr.com/ugd/a31856_e7239b33a97642d2a239b63c068b2c9f.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000dfbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDFBB 5116 bytes
SHA-256: c8d404cce4c2c2762d3a292f06b2d9fc04f9bb4920c7426499c2eac5e4242616
font_01_sfnt_off0000f135.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF135 10688 bytes
SHA-256: 16e4d41ac838c3c41c4369528b96bfff15844c9b518914e0f770f193de09bc30

Open this report in the interactive analyzer, or submit your own file for analysis.