Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bfe4e1e85dcf0fd…

MALICIOUS

PDF

19.3 KB Created: 2020-03-22 01:57:12 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-08
MD5: 3562fd27a45492c0696b45c72c628c3c SHA-1: 13b81991dbb5bc708c7bf01091eee790518bc2b9 SHA-256: 6bfe4e1e85dcf0fd47eed7ced9709f9e27cb2d8e42d25d01bb353ef2a2e6ebb9
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. The embedded URL points to a page with a title related to design methods, which is likely a lure. While no scripts were extracted, the presence of numerous external links indicates a high likelihood of directing users to potentially malicious or deceptive content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oddbutterflies.com/uploads/1/3/0/7/130774982/130774982.html#metodos+de+dise%C3%B1o+nigel+cross+descargar+pdf PDF link annotation
    • http://yorktownplumbingandheating.com/uploads/1/3/0/2/130271139/pasutesokaxobiwaxa.pdfIn PDF document text
    • http://www.crisptosc.com/uploads/1/3/0/3/130324044/3802812.pdfIn PDF document text
    • http://drshriver.com/uploads/1/3/0/8/130874601/2a116.pdfIn PDF document text
    • http://axedideelyingent.space/uploads/1/3/0/3/130323295/9055a3fbf70cce5.pdfIn PDF document text
    • http://theheadlandshotel.co.uk/uploads/1/3/0/8/130874492/7699150.pdfIn PDF document text
    • http://beardedbeaverco.com/uploads/1/3/0/6/130620679/26ecce3.pdfIn PDF document text
    • http://vps01.hms.com.au/uploads/1/3/0/6/130604782/8ca082c3c10bbc.pdfIn PDF document text
    • http://www.bubbaluna.co.uk/uploads/1/3/0/2/130289475/tadezaxolabumiv_duwojenij_pokebanepo_tewivakuwu.pdfIn PDF document text
    • http://j-aponi.com/uploads/1/3/0/3/130313120/gojotorap.pdfIn PDF document text
    • http://beautifulweddings.biz/uploads/1/3/0/9/130969837/8487560.pdfIn PDF document text
    • http://highmountianbuilders.com/uploads/1/3/0/8/130814337/samafir-zarebetanuratel-wozarox.pdfIn PDF document text
    • http://leaderkast.com/uploads/1/3/0/6/130639166/ruberusiporavunawu.pdfIn PDF document text
    • http://clinicgeek.org/uploads/1/3/0/8/130874670/sepubolutegozider.pdfIn PDF document text
    • http://ocruz.net/uploads/1/3/0/9/130969824/3297869.pdfIn PDF document text
    • http://www.zetrocroofing.com/uploads/1/3/0/4/130476372/3411016.pdfIn PDF document text
    • http://newtaiwankonus.com/uploads/1/3/0/5/130588403/tanod.pdfIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.