PDF static analysis report

Static analysis result for SHA-256 2f66693353b6c03b…

SUSPICIOUS

PDF

39.7 KB Created: 2020-04-04 12:40:00 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-09
MD5: a338cdb1ce4c71f0b00597ea75bf7443 SHA-1: 764ac0cc1470088c8ab1caed5f7b5b425148d181 SHA-256: 2f66693353b6c03bfd42021c3b91a7b81adf26ba526fda60a1ecc8809dc5e674
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains embedded URLs that mimic search result snippets, specifically for 'Mareez e ishq hoon main mp3 free download'. The ML classifier strongly flagged this PDF as malicious. The presence of multiple unknown reputation URLs suggests a potential phishing or malware distribution attempt, likely aiming to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sdrvowners.org/uploads/1/3/0/2/130272083/130272083.html#mareez+e+ishq+hoon+main+mp3+free+download PDF link annotation
    • http://boulevardcellars.com/uploads/1/3/1/3/131379540/989afb.pdfIn PDF document text
    • http://developmentechnwkllc.com/uploads/1/3/0/7/130739570/268a4e.pdfIn PDF document text
    • http://fivestarcleanersfl.com/uploads/1/3/0/9/130969414/bavarisetuw.pdfIn PDF document text
    • http://amooreeportfolio.com/uploads/1/3/1/4/131454098/688326.pdfIn PDF document text
    • http://www.ellenanhari.nl/uploads/1/3/0/3/130313434/72e66104793e2.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A10 15752 bytes
SHA-256: f03c507ba8ee2c69034bd109eab541714946270d394f4ff107766d656f5996cf
font_01_sfnt_off0000757a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x757A 6536 bytes
SHA-256: 55835614b43f7a489b46017f9b336247ac1fbf2231303d5416088a2c9f72e97c

Open this report in the interactive analyzer, or submit your own file for analysis.