Malicious PDF — malware analysis report

Static analysis result for SHA-256 20209f1f7df28337…

MALICIOUS

PDF

102.9 KB Created: 2021-04-09 02:43:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: c7e289fce2562519062ba78558ce0aab SHA-1: 4020c422720abb58f6a30f86093d2141a62b49f3 SHA-256: 20209f1f7df283373fc30c482b62c8f5e9310ac74bdf6c97a388789057b59759
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of external links, many of which point to other PDFs, indicating a link farm designed for SEO manipulation. The primary URL, 'https://seumenha.ru/strik?utm_term=tubidy+mp3+gratis+descargar', is identified as an SEO redirector, likely used to funnel users to malicious content under the guise of free downloads. While no scripts were explicitly extracted, the PDF structure and extensive link farm suggest an attempt to distribute malware or phishing content, aligning with spearphishing attachment tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9933

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=tubidy+mp3+gratis+descargar PDF link annotation
    • https://s3.amazonaws.com/tuxutedi/vozonosudetiwopize.pdfIn PDF document text
    • https://cdn.sqhk.co/sejixikerut/jhgdhhL/equalizer_2_soundtrack_end_credits.pdfIn PDF document text
    • https://s3.amazonaws.com/tazibabebamep/resifevafinujemejel.pdfIn PDF document text
    • https://s3.amazonaws.com/duzexefemosaxe/alex_rider_movie_2020_trailer.pdfIn PDF document text
    • https://s3.amazonaws.com/rodakarugupoko/synaptics_smbus_driver.pdfIn PDF document text
    • https://s3.amazonaws.com/jidagafinuxesu/face_detection_algorithm_java.pdfIn PDF document text
    • https://raxagipob.weebly.com/uploads/1/3/4/8/134883443/vemumufedave.pdfIn PDF document text
    • https://s3.amazonaws.com/vuxalirudidel/vuxubusibakedoxixat.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/24849422503.pdfIn PDF document text
    • https://s3.amazonaws.com/vavebufevodutob/9751419178.pdfIn PDF document text
    • https://zunaxezosepoto.weebly.com/uploads/1/3/0/7/130739564/9688575.pdfIn PDF document text
    • https://cdn.sqhk.co/matelasoguje/UetsPjc/arrowhead_golf_course_colorado_scorecard.pdfIn PDF document text
    • https://cdn.sqhk.co/samekikogeri/jhdw0jc/barcode_scanner_app_free_download.pdfIn PDF document text
    • https://munelexogetajax.weebly.com/uploads/1/3/1/4/131437313/40a19365d3f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/5949cfab-3d8f-4a68-80c9-972c0bc1443f/19528260751.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ae14e2d0-e476-41c6-a847-6816f84a0e05/how_to_wear_earbuds_without_hurting_ears.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/61ce1d93-671e-4425-9812-9de6648fbace/jamaica_kincaid_a_small_place_analysis.pdfIn PDF document text
    • https://997b2cc2-d96d-4654-b184-8a5d7ad473c0.filesusr.com/ugd/b8d08c_29cc9d81180e4dd3beaa11d5db8f19ed.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/b37db69d-e12d-45d0-8a9e-e3b9e309b6eb/wulukekelegalabewewobak.pdfIn PDF document text
    • https://72b50e20-f79f-40ca-96b4-24bef83e308f.filesusr.com/ugd/1a1092_90928fd134ee4998a240ce5a8c30bf11.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f796.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF796 6744 bytes
SHA-256: 8187145963fbf8e0b7977f93bb9cbfc296fb812f6e2b6f40a3c8d31ca5a797a4
font_01_sfnt_off0001084c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1084C 3032 bytes
SHA-256: b24d73991966bd902893c4711acd3e2cd7ba1d66eab78252bed061e1fea3bb32
font_02_sfnt_off0001131b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1131B 5716 bytes
SHA-256: 0a42fba7fdce33b9ec437bc66ded7b25e16588e6952ad1d3a619441adfdd8546
font_03_sfnt_off0001266d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1266D 4068 bytes
SHA-256: d13f296f030b05d167872429658a99196482c03f4d9eb125323addd8d038eba3
font_04_sfnt_off0001366f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1366F 13788 bytes
SHA-256: 9918bb98c9a0f888c3818efa68ff4496bf2f8ba95d8dcb841e1c07fc898f5568
font_05_sfnt_off0001623e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1623E 17512 bytes
SHA-256: 364f94cb8cddd70c8470235bfacb4396c819e3e4e08c2d5593d5772af2025ee8
font_06_sfnt_off00017b6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17B6C 6068 bytes
SHA-256: c31ff2157c2fe831d557430cfbbe6f58bc06db1196113c7c0019dcad2e8bb9cb

Open this report in the interactive analyzer, or submit your own file for analysis.