Malicious PDF — malware analysis report

Static analysis result for SHA-256 170d9953a73f4eb7…

MALICIOUS

PDF

67.6 KB Created: 2021-02-13 23:16:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 97df33bba6173e57f66d83036abd83a7 SHA-1: 321780c61398ab787b9e94c284d662613d106628 SHA-256: 170d9953a73f4eb7c8b68ac103a674733656f23caec300310adf670883c06c4f
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external links, many hosted on disposable domains, suggesting a link farm or redirection scheme. The presence of 'keygen' in a URL parameter indicates a lure for potentially illicit software, a common phishing tactic. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9149

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/aws?utm_term=cad+2010+keygen+free PDF link annotation
    • https://cdn.sqhk.co/fefamuve/giccqii/jovoti.pdfIn PDF document text
    • https://lemorixumo.weebly.com/uploads/1/3/4/7/134748879/zupubivima_kuwibirisog.pdfIn PDF document text
    • https://cdn.sqhk.co/gobajejuz/zp4hbhg/ziviserononagib.pdfIn PDF document text
    • https://cdn.sqhk.co/rivotoxupow/Kighahi/fleet_commander_nimitz.pdfIn PDF document text
    • https://cdn.sqhk.co/togokitaz/88OZm0A/xanoko.pdfIn PDF document text
    • https://daxosunusopudom.weebly.com/uploads/1/3/4/5/134510034/xumatuzoni-nodirumowiwe-joxiwixedagimo.pdfIn PDF document text
    • https://cdn.sqhk.co/denalivek/jiXjgij/e_trade_baby_now.pdfIn PDF document text
    • https://zadidiboz.weebly.com/uploads/1/3/5/2/135295834/famafiku-xipewotixi-vuwasubujusub.pdfIn PDF document text
    • https://fijuzezakuxulow.weebly.com/uploads/1/3/5/3/135391315/susitataxomadit-xesanisipagelu-gafojamibasene-vafenugefi.pdfIn PDF document text
    • https://rowiteruna.weebly.com/uploads/1/3/4/4/134470704/5561117.pdfIn PDF document text
    • https://vogifidawavuda.weebly.com/uploads/1/3/1/6/131636702/018f9.pdfIn PDF document text
    • https://cdn.sqhk.co/livefodam/bdrn4d4/39172215373.pdfIn PDF document text
    • https://cdn.sqhk.co/madagijoj/ghijage/60525599177.pdfIn PDF document text
    • https://pabedowilopore.weebly.com/uploads/1/3/1/1/131163579/xovugo-petadobupizuw.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/lewuli/33542952886.pdfIn PDF document text
    • https://s3.amazonaws.com/sefiwegegagu/jivoz.pdfIn PDF document text
    • https://s3.amazonaws.com/dazinibonofobi/72391663176.pdfIn PDF document text
    • https://s3.amazonaws.com/bezorito/cisco_ise_vm_installation_guide.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE72 3048 bytes
SHA-256: aa6fba9bd5ca1015d8b6bafc59bee7076340e89789842558e94f06d0f9a10e51
font_01_sfnt_off0000e949.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE949 5260 bytes
SHA-256: c0f34cf9b3ce4bc8897eb20d3f493eb506e08de512478273363d2532f4995f27
font_02_sfnt_off0000fb4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFB4A 5876 bytes
SHA-256: 7801440547def89ffb332e0ab821ee7df6ca048176e9eb04096ebb9700f85408

Open this report in the interactive analyzer, or submit your own file for analysis.