Malicious PDF — malware analysis report

Static analysis result for SHA-256 386790f0683eb8a2…

MALICIOUS

PDF

35.8 KB Created: 2020-03-20 04:26:51 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-07
MD5: 03827a9186c0757c57e6f7219c1e9c39 SHA-1: c7e3454cbcdf35de836aa99cf2669aafd3891979 SHA-256: 386790f0683eb8a29e3860302f0d71e71c7586b5b4f9b85439ceb82716c34e00
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

This PDF document is designed as a lure, presenting itself as a "God of War 3 walkthrough" to entice users to click on embedded links. The heuristic firings indicate it's an image-only document with an action trigger, a common tactic for phishing. The numerous external PDF links, including the primary one to learnwithag.com, suggest a redirection to a malicious site. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9974

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://learnwithag.com/uploads/1/3/0/9/130969439/130969439.html#god+of+war+3+walkthrough+ps3 PDF link annotation
    • http://niche-holdings.com/uploads/1/3/0/6/130622110/246158.pdfIn PDF document text
    • http://dougmcelroy.com/uploads/1/3/0/4/130488506/5cf2d922873.pdfIn PDF document text
    • http://firsttimeinkenya.org/uploads/1/3/0/2/130289431/samijewuxuv.pdfIn PDF document text
    • http://weldershare.com/uploads/1/3/0/2/130270894/lodamasadebuza.pdfIn PDF document text
    • http://webmail.cornishswimacademy.com/uploads/1/3/0/5/130541137/rujugufefok-gixiluxasudobi-noxapa-zosifuzu.pdfIn PDF document text
    • http://whiskysurvivor.com/uploads/1/3/0/4/130436362/3538905.pdfIn PDF document text
    • http://mx.omega-properties.com/uploads/1/3/0/5/130539265/3972237.pdfIn PDF document text
    • http://iaafri.org/uploads/1/3/0/6/130604361/a832c.pdfIn PDF document text
    • http://thebirthofchrist.com/uploads/1/3/0/7/130739247/2923944.pdfIn PDF document text
    • http://eastbayzerona.com/uploads/1/3/0/9/130968957/fdc925ddbd.pdfIn PDF document text
    • http://dementiasolutions.co.uk/uploads/1/3/0/3/130313098/5517856.pdfIn PDF document text
    • http://broke-guys-guide.com/uploads/1/3/0/4/130435590/6268813.pdfIn PDF document text
    • http://eddieqspeaks.com/uploads/1/3/0/6/130621451/3323872.pdfIn PDF document text
    • http://downsideups.com/uploads/1/3/0/3/130323097/weretasef-jatonokudozasu.pdfIn PDF document text
    • http://www.theguidefor.me/uploads/1/3/0/7/130776555/lejiwu-sifixaziderer-liduwadipad-nalowutelisarit.pdfIn PDF document text
    • http://goatplatform.com/uploads/1/3/0/2/130289801/wekoz-femepujaf-vageb-nitifibuluba.pdfIn PDF document text
    • http://planetemobile.net/uploads/1/3/0/6/130620945/polujo-juxajadefime-zafokid.pdfIn PDF document text
    • http://ratswithwings.net/uploads/1/3/0/4/130435755/bapuvaf.pdfIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.