Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f7806c4137b3307…

MALICIOUS

PDF

23.8 KB Created: 2020-05-22 13:28:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-09
MD5: 991cc95755f9b8d59d168c71b13c262d SHA-1: 8db352bc955e0d10796f25abfca7936115faf89e SHA-256: 5f7806c4137b3307b1b8812f3161cd84830329381464cd6e795d65753fc7d1ad
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body also contains a URL that appears to be a lure for a graphic novel. The primary function appears to be directing users to a network of websites, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://glightfoundation.org/uploads/1/3/0/5/130550789/130550789.html#the+adventure+zone+graphic+novel+pdf+free PDF link annotation
    • http://kellyzona.com/uploads/1/3/0/9/130968994/8534225.pdfIn PDF document text
    • http://becomeroyalty.org/uploads/1/3/0/6/130621965/1b63a.pdfIn PDF document text
    • http://myroofingorlando.com/uploads/1/3/0/9/130969997/komotagoxizetulefuti.pdfIn PDF document text
    • http://qnqrn.bpmtc.com/uploads/1/3/0/2/130272472/3368623.pdfIn PDF document text
    • http://iamaloe.com/uploads/1/3/1/6/131606874/nitidiwofuwel-xupepusikuxef-lofufuz.pdfIn PDF document text
    • http://valeriefong.com/uploads/1/3/0/3/130313323/f08c0e4b4f.pdfIn PDF document text
    • http://child-flower.org/uploads/1/3/0/3/130323286/3434070.pdfIn PDF document text
    • http://pbfengshui.com/uploads/1/3/1/0/131071180/447e1.pdfIn PDF document text
    • http://adsgoround.com/uploads/1/3/0/3/130323559/6124837.pdfIn PDF document text
    • http://harismalingua.com/uploads/1/3/1/3/131383325/bizadu_mopodedugipa_binuzapaxew_lewitupu.pdfIn PDF document text
    • http://isofoot.net/uploads/1/3/0/2/130289733/mutukakozov_texowajuw.pdfIn PDF document text
    • http://610zane.com/uploads/1/3/0/9/130969079/6f5bbe7bde0dc6.pdfIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.