Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a91bb9d8fcc7f2a…

MALICIOUS

PDF

82.5 KB Created: 2021-07-14 09:07:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: 68348ed0de00cdd72cdc24f70194a376 SHA-1: 9cc7c54ebf449edf0611818406629d0bbdabd5ad SHA-256: 4a91bb9d8fcc7f2a51783267d57cb64c0a8998f021a8f1e28d50cadfeeeccdfb
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, including a high-severity ML classifier and ClamAV detection. The presence of an external URI and an SEO redirector link suggests a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and heuristic firings indicate it is designed to trick the user into navigating to a malicious resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/razvivatel/yapz/~3/XMoLd4EPXkg/square?utm_term=wiki+miners+haven PDF link annotation
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60e8ee6c309bd63f3d83b392/1625878124361/veviboridutorunaripi.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6bff0d8d387fecc8b153/t/60ee2d2e9c71001bedf4d47b/1626221870902/five_nights_at_freddys_2_apk_hack.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60ed9f05f53e3457ef870021/1626185477546/nelejajemoxivuzunenu.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e9273c0cbdad4d35060ae1/1625892668624/wow_starter_edition_limitations.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e84d8ac1820d4d807dea65/1625836938489/arteries_and_veins.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee6bc5bb85ab7f02bfc449/1626237893345/66757363167.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee5f5307d0587a37654b32/1626234707263/6655360748.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60eca7d2704a383bbedd153d/1626122194914/your_vs_you_re_worksheet.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60ecb6514b894625970ff0c1/1626125905290/pdf_to_excel_convertor_online_free.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60edca1f24c32e4364b1e13e/1626196511175/gilofajisewomevufarop.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac59fb7e9621e2f466549/t/60ee129c7d49fb55d62402dc/1626215068766/close_database_connection_in_php.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac52a97a1d73ddacfe14c/t/60eca74790a3fc49531ca86e/1626122056045/fesukukutot.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac5994c6b1805bc4acbdb/t/60ee77ab5f7927514e409609/1626240939117/electron_dot_structure_of_h2s_and_f2.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4e0d5abe22cec5c4b22/t/60e9294adb8bb141bad9af52/1625893195003/imao_meaning_text.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60e7d148fdc75e32ab0719c6/1625805128272/differentiate_between_simple_tissue_and_complex_tissue.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee0c57fd66ff3739ea88c9/1626213463562/ethics_integrity_and_aptitude_by_subbarao.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e9598537cb904475619f99/1625905541650/what_does_it_mean_to_be_coined.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e20c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE20C 17068 bytes
SHA-256: 7aa09323cdd6a45978b306d6078d6b69523112e3f94e8e81ef425b245e9e1156
font_01_sfnt_off00010eb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10EB1 10260 bytes
SHA-256: 3168940027cf78ef98193f6124364f9bbedf80dd7bfcab16533d2682ed288cdb
font_02_sfnt_off00012581.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12581 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.