Malicious PDF — malware analysis report

Static analysis result for SHA-256 7595f582a338cff0…

MALICIOUS

PDF

82.7 KB Created: 2021-03-20 12:03:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 16766965d5fa100151db28e2ab01ca7d SHA-1: ddce1a6e3528db4eb615af8fb1d7c901527dd271 SHA-256: 7595f582a338cff06e65c27f19f23a951bb29fd19af669737afa188b5599fee3
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded URLs that redirect to a suspicious domain, likely as part of a phishing or scam campaign. The ML classifier strongly indicated maliciousness, and the PDF structure suggests it's a link farm designed to host numerous deceptive links. The document body, though heavily obfuscated, contains keywords related to troubleshooting, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vilenefex.ru/strik?utm_term=maytag+bravos+xl+washer+troubleshooting PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4446638/normal_5ffe82cbd6ac5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4407084/normal_5feb22de6882c.pdfIn PDF document text
    • http://sebokuxaxugu.iblogger.org/what_could_cause_constant_acid_reflux.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369784/normal_6027e4ed3a0b2.pdfIn PDF document text
    • http://wizatone.iblogger.org/bumblebee_car_form.pdfIn PDF document text
    • http://xexogafuko.22web.org/79541998154.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426815/normal_5fda24610eae8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://mafuwiwoxosom.rf.gd/rational_functions_domain_and_range_worksheet.pdfIn PDF document text
    • http://lapumugafo.rf.gd/elephant_ears_template.pdfIn PDF document text
    • https://9afb1793-bc57-4514-bb46-74e980466609.filesusr.com/ugd/11f207_74ab4e460bcc4b2bb5c433228283b4bf.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/nunakixuma/73372492019.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/97deca8e-56d0-4f76-bfb5-16767d5af5c3/saxon_math_homeschool_8_7_answer_key.pdfIn PDF document text
    • https://s3.amazonaws.com/midaguvimabof/can_you_sue_someone_for_car_damages.pdfIn PDF document text
    • http://rodiwube.epizy.com/hypertension_who_fact_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e055d7c4-03ba-4109-ab95-2eeb023ab7d1/what_will_happen_to_plants_that_are_kept_in_the_dark.pdfIn PDF document text
    • https://58f604bd-1fd8-4cfe-af9b-f15e67d030d5.filesusr.com/ugd/9a7439_2e7a05d2206c4c4ea25d7140231a87ff.pdf?index=trueIn PDF document text
    • http://kewivifonawati.epizy.com/sample_teacher_comments_for_preschool_report_cards.pdfIn PDF document text
    • https://4095172d-bd2f-4181-91d7-dd424e653400.filesusr.com/ugd/df73ab_d4dbfc34d3bc497992abddeb024626e5.pdf?index=trueIn PDF document text
    • https://89f68ddc-9f98-4e60-8afa-3e0ca6603e9e.filesusr.com/ugd/4725f1_17da3bfd4a0f44b68448c9760445b1b4.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fa4f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA4F 5412 bytes
SHA-256: 45e986a21a0fe61be70965b307b65a06bc3863c1fc46c5a6715ee18977edfe14
font_01_sfnt_off00010cd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CD5 1800 bytes
SHA-256: a36eee06fef6ce219692c4ec918276ac99413e4fd1e3666e4031624f9289d620
font_02_sfnt_off00011562.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11562 11740 bytes
SHA-256: 5a2b002906e85eded69f717c4a65ebac6017e986105e4855934dccf65ec6d470

Open this report in the interactive analyzer, or submit your own file for analysis.