Malicious PDF — malware analysis report

Static analysis result for SHA-256 353c64a4d14e9ff7…

MALICIOUS

PDF

77.8 KB Created: 2021-03-25 17:39:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: ecc79704cadd876d5ad11d924d7b51c6 SHA-1: ac3b55f70f2848658c0d38e080f8e9aed343e93d SHA-256: 353c64a4d14e9ff75af266931a719217890fcde99d200d0d1d9088438f3883dd
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a lure related to 'french manicure guide strips' and includes an external URI that redirects to a suspicious domain. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. No scripts were extracted, but the embedded URLs suggest a phishing attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mezovuduw.ru/wix?keyword=where+to+buy+french+manicure+guide+strips PDF link annotation
    • https://cdn.sqhk.co/nowonipewo/hcYAU1p/lego_marvel_super_heroes_2_ps4_walkthrough.pdfIn PDF document text
    • https://cdn.sqhk.co/tagodepa/Uqlgijd/dude_perfect_bowling_trick_shots_2.pdfIn PDF document text
    • https://cdn.sqhk.co/lumozupa/fShaV3K/coulomb_s_law_experiment.pdfIn PDF document text
    • https://cdn.sqhk.co/vabadoma/oShgT3p/41206185445.pdfIn PDF document text
    • https://cdn.sqhk.co/begorukenega/Qg84hb7/asalem_gurthukuradhu_video_song.pdfIn PDF document text
    • https://cdn.sqhk.co/tumosirewuw/ja1rias/game_hack_speed_hack_game_free_fire.pdfIn PDF document text
    • https://cdn.sqhk.co/novitovikor/RvKjenh/the_hangover_cast.pdfIn PDF document text
    • https://cdn.sqhk.co/fogobewataja/big3geI/56907797140.pdfIn PDF document text
    • https://cdn.sqhk.co/suxugipajepo/jcTmqIG/5240952502.pdfIn PDF document text
    • https://cdn.sqhk.co/ravusigi/dsPhahd/51232519365.pdfIn PDF document text
    • https://cdn.sqhk.co/ravusigi/aAgedid/6038192321.pdfIn PDF document text
    • https://cdn.sqhk.co/dogilijesiwu/ajgZZme/dance_movies_ballet_hip_hop.pdfIn PDF document text
    • https://cdn.sqhk.co/zotevokep/icB1RDg/18664914178.pdfIn PDF document text
    • http://pinenud.mygamesonline.org/99061642517.pdfIn PDF document text
    • http://nepatokada.mypressonline.com/86254678389.pdfIn PDF document text
    • http://vesajob.getenjoyment.net/tica_a_nicmaco_aristteles_livro.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8bac4862-af34-4870-bca3-970ef42069f3/19087208597.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90e3b8eb-8bf1-428a-a031-17a8e6f77dde/mororikiv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5f0e7a9c-7da2-4717-8e5f-8cee5454dd46/what_is_the_formula_for_a_right_angle_triangle_area.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/44e404fd-179f-4c90-9554-5c457694668f/mefobopefoxedesi.pdfIn PDF document text
    • http://mizetum.onlinewebshop.net/budumezutola.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d8a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD8A7 5792 bytes
SHA-256: 07a67373bd2886e52a0d193fecaeda5aeb36506d082eddd13045263d1a32f8a2
font_01_sfnt_off0000ec4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEC4F 11340 bytes
SHA-256: f73b68ebb6898de41f9c1500a2727e3da4b14cbc552e86716185e75cfeac9c44
font_02_sfnt_off0001123f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1123F 16204 bytes
SHA-256: a109d5cc1a8599929bd7702a943337bd153faf2776ff4e30ac39a15e38c17cef