Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c9d61fcab6d0c64…

MALICIOUS

PDF

111.6 KB Created: 2021-06-02 20:08:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 90d232b0937d2e4a6e9056eebcf16275 SHA-1: 1da418e8d864e7cff3f5ae22490c68bc955d0d3f SHA-256: 4c9d61fcab6d0c647cc29ff1a90d1f1f948d270602daaa175ca6f6e21261d42b
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which point to disposable domains or are part of a link farm, indicating a phishing or malware distribution attempt. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4319

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=%25D0%25B3%25D1%2583%25D0%25B3%25D1%258A%25D0%25BB+%25D0%25BF%25D1%2580%25D0%25B5%25D0%25B2%25D0%25BE%25D0%25B4%25D0%25B0%25D1%2587+%25D0%25BE%25D1%2582+%25D0%25BD%25D0%25B5%25D0%25BC%25D1%2581%25D0%25BA%25D0%25B8+%25D0%25BD%25D0%25B0+%25D0%25B1%25D1%258A%25D0%25BB%25D0%25B3%25D0%25B0%25D1%2580%25D1%2581%25D0%25BA%25D0%25B8 PDF link annotation
    • https://retagavit.weebly.com/uploads/1/3/4/3/134363188/sumezivulonife.pdfIn PDF document text
    • https://bizitodavil.weebly.com/uploads/1/3/4/3/134321392/fuzamofukidok.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457586/normal_5fef6b6670319.pdfIn PDF document text
    • https://buvowanux.weebly.com/uploads/1/3/4/6/134685119/xuwamaxef.pdfIn PDF document text
    • https://betivina.weebly.com/uploads/1/3/0/7/130774994/rujagopogerak_luponofob_konojuzedetako_wizej.pdfIn PDF document text
    • https://wunogalabapa.weebly.com/uploads/1/3/4/6/134603674/eefb3d45.pdfIn PDF document text
    • https://woralolur.weebly.com/uploads/1/3/4/3/134359953/7819497.pdfIn PDF document text
    • https://popoxalisasuper.weebly.com/uploads/1/3/0/7/130775362/2424099.pdfIn PDF document text
    • https://bemisawu.weebly.com/uploads/1/3/4/7/134716701/c19a941522f.pdfIn PDF document text
    • https://beponelife.weebly.com/uploads/1/3/1/1/131164358/digokil.pdfIn PDF document text
    • https://sufosuzupunu.weebly.com/uploads/1/3/1/3/131379650/walaza_pomosifi_toroxenurav.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473047/normal_6037c944807cd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419003/normal_5ffde32bb708d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.indictrans.orgIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://xugilip.pbworks.com/w/file/fetch/144487113/tivos.pdfIn PDF document text
    • http://pigedigasexu.pbworks.com/f/gidejokoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a03a76a-6268-40ee-a037-73d5c7a33af2/37623038028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02372805-8efb-4670-b71c-3676d0f981ad/how_to_beat_the_labyrinth_in_god_of_war_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc0b76a1-a79b-4401-ae24-df5fb7b5ef5f/how_to_prepare_to_be_an_orthodontist_in_high_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d757394-5c9f-4356-87c4-dd028bd2ad86/introduction_to_coding_for_beginners_youtube.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0eae220d-49b4-4cd2-86ac-3d7f8ee82ef1/56328625127.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48aafce1-33f2-4908-bdcf-6a5dfb1ba61b/choose_your_own_adventure_online_interactive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf50c965-9544-41d0-977d-e4f7ea3ccc22/jidezatapufal.pdfIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 13

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC4B 7916 bytes
SHA-256: 4fca73d47fa94a6ad668c0f4434483fdc2f54e6be5ae77a011c3735f5dfefd3b
font_01_sfnt_off000110ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110AC 6484 bytes
SHA-256: ee2530f169c748cd60c895f7ba5165278924119268fafb828b8506f09863a3e7
font_02_sfnt_off00012711.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12711 6000 bytes
SHA-256: f85a276e3360af38407e51108d9f929ffbd5ab8406c92cd0c1845e6fde22aa99
font_03_sfnt_off00013b1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B1E 2656 bytes
SHA-256: dbaab8dcf32bfe64cb008f34eb54f5316f62236e8dffe3de49b44225404383a5
font_04_sfnt_off00014620.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14620 4140 bytes
SHA-256: 7073f777ec002e82a856420936458262fa3cc3b4ee0437ed56f01fa51c4379d2
font_05_sfnt_off0001533e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1533E 3048 bytes
SHA-256: 2f58f42410b60611991c12283e964e03297a95500ca09b14f4d605296bc50bc4
font_06_sfnt_off00015f47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F47 4544 bytes
SHA-256: 53570b1addc227c644bcbe5fafcce3e1ca8a5779b7722260ef5244079f464722
font_07_sfnt_off00016d4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16D4D 2328 bytes
SHA-256: 864cbe2c6973b44d2b71e19ffbffb2328dcb3759b07ceb43c11d5a372fc4956d
font_08_sfnt_off0001780c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1780C 2604 bytes
SHA-256: 0e4b190990c22158f359a0de2485c61736e93a484cfb226f63bccb9bc1da1b2f
font_09_sfnt_off0001832c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1832C 2108 bytes
SHA-256: d117309382da938f7dffedc42f90dd4217b4d540d75629b80669d975ecbc171e
font_10_sfnt_off00018ccb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18CCB 3840 bytes
SHA-256: 5b8e8035f8940535bfb5f3d78de7d5c45dbc51c905faa5d9788b8fc152e96872
font_11_sfnt_off00019ae4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19AE4 4336 bytes
SHA-256: 87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284
font_12_sfnt_off0001a884.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A884 6148 bytes
SHA-256: 149738eb3e1d0bfb4a5732e89a115965e6f0cf3fc4971c694d3ce3619176544d

Open this report in the interactive analyzer, or submit your own file for analysis.