Malicious PDF — malware analysis report

Static analysis result for SHA-256 33b9ed925ce1a6c5…

MALICIOUS

PDF

73.6 KB Created: 2021-02-24 16:54:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 94e1c61e751b58bb9e0fa9c180663795 SHA-1: 8eea55dddcd9519904e8c06a49a7e73f06c711c9 SHA-256: 33b9ed925ce1a6c52843f5612001dec9f01ec439375df7eb92b8e6066a4f9615
242 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF contains a large number of embedded links, many pointing to disposable domains, which is indicative of a link farm designed to manipulate search engine results or distribute malicious content. The presence of a critical heuristic firing for PDF_MALICIOUS_REDIRECTOR_LINK and ClamAV detection further supports its malicious nature. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, which aligns with the link farm strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9803

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crophysi.ru/award?keyword=the+memory+book+by+harry+lorayne+and+jerry+lucas+pdf+free In PDF document text
    • http://ideaita.fun/nifevusowiruxoduli21e3h.pdfIn PDF document text
    • https://zofekumu.weebly.com/uploads/1/3/4/7/134741387/ranadaparemoguwe.pdfIn PDF document text
    • http://azorocheat1.xyz/bukawimobogigotiral648z.pdfIn PDF document text
    • http://mebelintera.ru/soguvarevodaruwotazou2kwb.pdfIn PDF document text
    • http://xtreme-sport.ru/disney_sorcerer_s_arena_best_characters_july_2020qg7dk.pdfIn PDF document text
    • https://s3.amazonaws.com/kuxuxemu/funny_cartoon_hd_images.pdfIn PDF document text
    • https://kitozegukelod.weebly.com/uploads/1/3/6/0/136056839/vijarupivamozur-xulebuzu.pdfIn PDF document text
    • https://s3.amazonaws.com/zumezeviwakiz/8374760884.pdfIn PDF document text
    • https://lewesasegejawu.weebly.com/uploads/1/3/5/3/135315787/guzatokewokokek.pdfIn PDF document text
    • https://vutakajar.weebly.com/uploads/1/3/4/8/134896426/mireregamilu_xofikusama_gorupalixaro_fevaner.pdfIn PDF document text
    • https://tutamedu.weebly.com/uploads/1/3/1/8/131856186/falixerakunuteximife.pdfIn PDF document text
    • http://help-nanny.site/vipegiletesemob6zqph.pdfIn PDF document text
    • https://julavatevimire.weebly.com/uploads/1/3/4/6/134669339/2731713.pdfIn PDF document text
    • https://s3.amazonaws.com/vesubodufisi/36410724938.pdfIn PDF document text
    • https://cdn.sqhk.co/zinoliwomi/jbgegdO/paycell_kart_limiti.pdfIn PDF document text
    • https://cdn.sqhk.co/kenoramof/hiz4Nhe/how_to_pass_pt_test_in_2_weeks.pdfIn PDF document text
    • https://s3.amazonaws.com/minegikukovel/zedodifixujufise.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000111e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111E9 5728 bytes
SHA-256: 340e13cc630585b50af00b589ad3944ff3baded6e5f705471c3631df27c2fa4b

Open this report in the interactive analyzer, or submit your own file for analysis.