Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e5bb1cb3dfa61a2…

MALICIOUS

PDF

61.3 KB Created: 2021-02-26 11:53:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: a7a23045da274e31dbbfb236e94de269 SHA-1: 217599d61c6c40af1f0c460c608347eecd5ec1bf SHA-256: 0e5bb1cb3dfa61a23d693489039db6b7161344761d9e31199eeca0d3a4e755e2
182 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, with at least one identified as a known malicious redirector. The heuristic 'PDF_MALICIOUS_REDIRECTOR_LINK' and the ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs. The presence of multiple disposable domains and link farms further supports a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7054

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=how+to+return+online+orders+old+navy In PDF document text
    • http://songkfrk.site/hambriento_nach_descargarxf1wx.pdfIn PDF document text
    • http://subonus.ru/rimozelizugorigubolife4swxl.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375531/normal_5fd2eabcd00c7.pdfIn PDF document text
    • http://shoop-fl.ru/amendments_of_the_us_constitutiondre8w.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378621/normal_601d8ad1310c6.pdfIn PDF document text
    • http://suzamajotibe.mywebcommunity.org/2655177033.pdfIn PDF document text
    • http://theboldpantsproject.com/kubota_v1505-t_parts_manualpvh9z.pdfIn PDF document text
    • https://cdn.sqhk.co/vifutetax/jfhaqii/27149771192.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4384145/normal_600b36a5f1837.pdfIn PDF document text
    • http://healsmall.space/zareba_fence_charger_acc2aezf2.pdfIn PDF document text
    • http://academic-club.ru/current_top_scorer_premier_league_2020ldqk9.pdfIn PDF document text
    • http://numumodi.epizy.com/fitizezizalagadivipat.pdfIn PDF document text
    • http://novuvajuvenexe.epizy.com/sopazuzoxitaru.pdfIn PDF document text
    • http://baperosuvo.rf.gd/cctl_vessel_berthing_report.pdfIn PDF document text
    • http://livirava.atwebpages.com/behringer_xenyx_x1204usb_driver_windows_10.pdfIn PDF document text
    • http://diwiludoki.rf.gd/logitech_wireless_mk320_drivers.pdfIn PDF document text
    • http://nejesezape.myartsonline.com/how_to_reset_bluetooth_earbuds.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.