Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d3e7e4e114b114a…

MALICIOUS

PDF

139.1 KB Created: 2021-05-30 05:33:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 73ed85490b6ba1c3cc5eed415eb04ab4 SHA-1: 9f03b43b4f191ec17178c4c454df0a9e7a9fe218 SHA-256: 3d3e7e4e114b114a3ae118da4fef838f6c79c91b796a617319d7dbd01f58710e
186 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link farm designed to direct users to external websites, with one prominent URL suggesting a "brawl stars hack apk". This indicates a phishing or scam attempt. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it's designed to host numerous links, likely for SEO manipulation or to distribute malicious content. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8430

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/strik?utm_term=brawl+stars+hack+apk+16.+1767 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4414672/normal_602f567002703.pdfIn PDF document text
    • https://puwikopigab.weebly.com/uploads/1/3/1/1/131163601/9861506.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4368984/normal_5fc9d7110fb5e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403819/normal_6021e9c01025e.pdfIn PDF document text
    • https://tibiwurab.weebly.com/uploads/1/3/2/6/132695994/348900.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387702/normal_5fcf59c8e5957.pdfIn PDF document text
    • https://novomegaweg.weebly.com/uploads/1/3/4/7/134738931/2305044.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374851/normal_5fe9090bcbec1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405674/normal_6002f2d4b953b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4466368/normal_601b04f72f549.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4383467/normal_6010446669260.pdfIn PDF document text
    • https://sumigixutaruxaj.weebly.com/uploads/1/3/4/7/134748626/38003d35.pdfIn PDF document text
    • https://ximixejolulozo.weebly.com/uploads/1/3/4/3/134351986/9202025.pdfIn PDF document text
    • https://static.s123-cdn-static-d.com/uploads/4443362/normal_60b03d623e945.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4453743/normal_604f14061d3c6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4421210/normal_5fc6775736e74.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.indictrans.orgIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://uploads.strikinglycdn.com/files/825f7e07-8268-4b4c-af70-0fa8ced514da/nivumagowuwilopobigori.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a7ee4874-a6e9-49f6-ad82-eab6a1cabe8d/lumoruganutidurotuxiwovud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0d8905e-1ac4-4623-8660-b66dc528f1c6/94045755844.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/17da04b2-5af6-47fc-9c2d-231638fbdee3/how_to_play_21_with_uno_cards.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e72a40c1-4d78-4225-a7e7-c9a775e419b6/1028748234.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.orgIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 17

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off0001dd07.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1DD07 19380 bytes
SHA-256: 511f24356c9cfa0cb561270164dcd905744b8cc3c392e109a9c132e7eb49662d
font_00_sfnt_off0000eebd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEEBD 7916 bytes
SHA-256: e679725072c74ab1de830ba6dd25101ec2f6d7be962e72d99a133184e56e62d0
font_01_sfnt_off0001031d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1031D 6484 bytes
SHA-256: c83fd9d1b431f7b9dc5f903d49d0aecfddc282b3a5950cb10d6ab18e6e767f35
font_02_sfnt_off00011981.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11981 5544 bytes
SHA-256: 9593ea7f7950fe17bcdf074fcba7715261831ba7c30d708a5107941baf180ce8
font_03_sfnt_off00012c77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C77 2656 bytes
SHA-256: c206ac4eca120f096112d408dff6b33a2f721090936d80486df636e1cd240fde
font_04_sfnt_off0001377b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1377B 4140 bytes
SHA-256: fbdd9df555c8710fa493947bde41d1b30e4b750f457ece442df516a7dd53c510
font_05_sfnt_off00014497.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14497 3048 bytes
SHA-256: 4bb619f7e4c8d10c6650d66271e6db770d7def95493d885be3efe54e7c100c22
font_06_sfnt_off0001509f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1509F 4544 bytes
SHA-256: 8de763cc392d555d6555ce28e49a7801ce7361977d5c0c1f0cca23967a7df2d1
font_07_sfnt_off00015ea9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15EA9 2328 bytes
SHA-256: 3702365b3034b9d7945da23b991b5e2ac3f8bb06d1ba3be7e5ba1b5d8dd48c9f
font_08_sfnt_off00016967.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16967 2604 bytes
SHA-256: 7f3a1ef136f36ba68bc36e5bcd31de243dce7f4b60e01c4bc40f508baeb48ca0
font_09_sfnt_off0001748a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1748A 2108 bytes
SHA-256: e66bd646ff29f48b94a898642357a1d5295b77faffa0bd70eb77acb4aebc9a97
font_10_sfnt_off00017e2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17E2A 3840 bytes
SHA-256: cca5298ad2e89ab0d41cc63a8205340d9321530172a8d5dda1c28d17fa56adaa
font_11_sfnt_off00018c42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18C42 4336 bytes
SHA-256: 87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284
font_12_sfnt_off000199e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x199E2 6148 bytes
SHA-256: 4910d0177da9f60ecc92c13a34fae8c5c38ffafb9e4e22a3c3fd987548b79157
font_13_sfnt_off0001a9cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A9CD 17888 bytes
SHA-256: 36fa24f581c466a8199ae0f2cabdad0bb4896b5a9f892fc5f1757a1dd2badcc5
font_15_sfnt_off0001fe76.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FE76 3612 bytes
SHA-256: e6a127d4807db9283a7accf384a78a2b0e3b5516854c6cc3c0883f933369f6f8
font_16_sfnt_off00020c95.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20C95 4216 bytes
SHA-256: f2ee77ef46d574326e15e5d832115933ac9a59561f08735e614fb36f91e87993

Open this report in the interactive analyzer, or submit your own file for analysis.