Malicious PDF — malware analysis report

Static analysis result for SHA-256 25c28d2802c088c6…

MALICIOUS

PDF

62.9 KB Created: 2021-02-12 01:19:52 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 73d28ae4b4b080df52a014a89f09805d SHA-1: 6f6cc4d9bf997c9e1fd3030689213e492f0a5645 SHA-256: 25c28d2802c088c61b97ec3d1811f29f00a5f93541b252b29396ef4b0fc1308d
196 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or redirection scheme. The primary URL, https://maypoin.ru/123, is likely part of a phishing or malware distribution campaign. No scripts were extracted, but the PDF structure itself facilitates the redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9755

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/123?utm_term=mfj+deluxe+versa+tuner+ii+949e+manual PDF link annotation
    • https://voliguxuzewiwa.weebly.com/uploads/1/3/4/7/134762967/debib_zepikepuw_mafufude_vekigamit.pdfIn PDF document text
    • http://maska-respirator.shop/hockey_training_programme6kwsd.pdfIn PDF document text
    • http://misstourist.info/datememowazdwsso.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4475000/normal_5fff305f04431.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480173/normal_600622d335582.pdfIn PDF document text
    • https://zelogevoge.weebly.com/uploads/1/3/1/4/131483318/f9a4e1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4465127/normal_6007005357d3c.pdfIn PDF document text
    • https://wofexajolevesi.weebly.com/uploads/1/3/5/3/135302186/616645ce.pdfIn PDF document text
    • https://tuxewuwa.weebly.com/uploads/1/3/4/7/134776055/a20e95.pdfIn PDF document text
    • https://rotarivinevi.weebly.com/uploads/1/3/4/5/134599250/tuzarikogokavob-zidejodafi-gobugo-fotipabi.pdfIn PDF document text
    • https://xojovirasada.weebly.com/uploads/1/3/1/6/131637125/binirujukepi.pdfIn PDF document text
    • https://ruxebawinafa.weebly.com/uploads/1/3/0/7/130776533/nakorugat-gezegav.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374978/normal_6001e2cd90881.pdfIn PDF document text
    • https://weduparazibad.weebly.com/uploads/1/3/4/7/134710999/xukawexakiwaturojuzo.pdfIn PDF document text
    • https://wabobileminila.weebly.com/uploads/1/3/5/4/135400898/c7919199f8.pdfIn PDF document text
    • http://artrosil.xyz/future_tense_worksheets_for_grade_4pcywi.pdfIn PDF document text
    • https://mujolimu.weebly.com/uploads/1/3/4/8/134868529/5083763.pdfIn PDF document text
    • http://arnautmebel.ru/dictionnaire_francais_arabe_phonetiquew4wmk.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c299.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC299 5508 bytes
SHA-256: fc8bbb9a4351e016f5157c61573e3d793b09ee154569c01ab1cb1b0613e876d0
font_01_sfnt_off0000d55c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD55C 10040 bytes
SHA-256: 8126a5837d20dc7f8d345d4cb3e1cfaf5f2024a770f2c9fa7f9638825c45a815

Open this report in the interactive analyzer, or submit your own file for analysis.