Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d07b7951ae2292f…

MALICIOUS

PDF

100.5 KB Created: 2021-03-09 20:05:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 7a7eb0fb68c7ea74db62ce04fd038272 SHA-1: 13eb04147ff8ecd1baa82cb7afed75bcbaeac0e8 SHA-256: 6d07b7951ae2292f029c4f0f93e9c398043654812e612c6224e4cee61c4f6cf3
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded URLs, with a high-confidence ML classifier flagging it as malicious. One prominent URL, 'https://vilenefex.ru/strik?utm_term=associated+laguerre+polynomials', is identified as a potential link farm on disposable hosting, suggesting a lure for phishing or malware delivery. No scripts were extracted, but the overall structure and URL distribution indicate a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=associated+laguerre+polynomials PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4421341/normal_5fd2efa81dfea.pdfIn PDF document text
    • http://nokojatagi.mywebcommunity.org/how_to_remove_clutch_on_homelite_chainsaw.pdfIn PDF document text
    • http://rumurel.mywebcommunity.org/where_are_there_food_banks_near_me.pdfIn PDF document text
    • http://pedrons.space/free_online_excel_courses_with_certificate_irelandux8s8.pdfIn PDF document text
    • http://pifofobexaxel.mypressonline.com/nazajalopolebiwesusa.pdfIn PDF document text
    • http://wivevadevenumet.mywebcommunity.org/45056342885.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387421/normal_6042fbb5635e1.pdfIn PDF document text
    • http://levantemosaic.com/charles_taylor_sources_of_the_self_sparknotes50gx0.pdfIn PDF document text
    • http://fifonugimexa.22web.org/whatsapp_versi_android_4._2_2.pdfIn PDF document text
    • http://aycotoro0.xyz/zotani78jja.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6b0c0bc4-fa67-45a2-b8f6-5d169474acea/47868519702.pdfIn PDF document text
    • http://miwewugewu.atwebpages.com/19459745129.pdfIn PDF document text
    • http://bodegifu.atwebpages.com/puturimoxukiwaboxiputu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/69483120-c6e0-4144-816f-f33f3daf10d6/us_navy_evaluation_writing_guide.pdfIn PDF document text
    • http://bitujiduruv.myartsonline.com/88596087832.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/007902f4-2227-4593-be0f-adae2878a36d/99875376730.pdfIn PDF document text
    • http://raziwisubuza.rf.gd/65842864469.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/265f51f6-175f-4698-9d44-c7df3f4acd2a/3_types_of_services_ap_human_geography.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5793e965-27f6-47be-9374-66b9772714e1/is_a_jump_discontinuity_removable_or_nonremovable.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001286e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1286E 5484 bytes
SHA-256: ca2fcd3adefaee3656cf0aeb06dc818ade6b08809a16a475d40140eed00e78b6
font_01_sfnt_off00013b0c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B0C 15508 bytes
SHA-256: a4f9a00cba7df8556a3e75602bec7c9af4e34509d863899a3cfca139eb5355f8
font_02_sfnt_off00016b89.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16B89 16688 bytes
SHA-256: b3ce5a7ca026c0a2755e971a0c7f1b70425c1ef356988ecb41e500d1a2bbbd90

Open this report in the interactive analyzer, or submit your own file for analysis.