Malicious PDF — malware analysis report

Static analysis result for SHA-256 798a5239b65517ef…

MALICIOUS

PDF

134.5 KB Created: 2021-06-02 20:08:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 9d2ad7a319a55e83423f7230280aedaf SHA-1: b024aa1f1687a9c8416d95ac090db55932cf8ac6 SHA-256: 798a5239b65517efa4321aba7f6a4f4eb0b12b67c2cb5fcfbff7702523e5b862
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, many of which are hosted on disposable domains and utilize UTM parameters, indicative of a link farm designed for phishing or redirecting users to malicious content. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment. No scripts were extracted, but the structure and URL patterns strongly suggest a phishing or scam campaign.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4628

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://infrive.ru/pbw?utm_term=%25D0%25B3%25D1%2583%25D0%25B3%25D1%258A%25D0%25BB+%25D0%25BF%25D1%2580%25D0%25B5%25D0%25B2%25D0%25BE%25D0%25B4%25D0%25B0%25D1%2587+%25D0%25BE%25D1%2582+%25D0%25BD%25D0%25B5%25D0%25BC%25D1%2581%25D0%25BA%25D0%25B8+%25D0%25BD%25D0%25B0+%25D0%25B1%25D1%258A%25D0%25BB%25D0%25B3%25D0%25B0%25D1%2580%25D1%2581%25D0%25BA%25D0%25B8 PDF link annotation
    • https://retagavit.weebly.com/uploads/1/3/4/3/134363188/sumezivulonife.pdfIn PDF document text
    • https://bizitodavil.weebly.com/uploads/1/3/4/3/134321392/fuzamofukidok.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4457586/normal_5fef6b6670319.pdfIn PDF document text
    • https://buvowanux.weebly.com/uploads/1/3/4/6/134685119/xuwamaxef.pdfIn PDF document text
    • https://betivina.weebly.com/uploads/1/3/0/7/130774994/rujagopogerak_luponofob_konojuzedetako_wizej.pdfIn PDF document text
    • https://wunogalabapa.weebly.com/uploads/1/3/4/6/134603674/eefb3d45.pdfIn PDF document text
    • https://woralolur.weebly.com/uploads/1/3/4/3/134359953/7819497.pdfIn PDF document text
    • https://popoxalisasuper.weebly.com/uploads/1/3/0/7/130775362/2424099.pdfIn PDF document text
    • https://bemisawu.weebly.com/uploads/1/3/4/7/134716701/c19a941522f.pdfIn PDF document text
    • https://beponelife.weebly.com/uploads/1/3/1/1/131164358/digokil.pdfIn PDF document text
    • https://sufosuzupunu.weebly.com/uploads/1/3/1/3/131379650/walaza_pomosifi_toroxenurav.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4473047/normal_6037c944807cd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4419003/normal_5ffde32bb708d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.indictrans.orgIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://xugilip.pbworks.com/w/file/fetch/144487113/tivos.pdfIn PDF document text
    • http://pigedigasexu.pbworks.com/f/gidejokoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3a03a76a-6268-40ee-a037-73d5c7a33af2/37623038028.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/02372805-8efb-4670-b71c-3676d0f981ad/how_to_beat_the_labyrinth_in_god_of_war_3.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fc0b76a1-a79b-4401-ae24-df5fb7b5ef5f/how_to_prepare_to_be_an_orthodontist_in_high_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d757394-5c9f-4356-87c4-dd028bd2ad86/introduction_to_coding_for_beginners_youtube.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0eae220d-49b4-4cd2-86ac-3d7f8ee82ef1/56328625127.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48aafce1-33f2-4908-bdcf-6a5dfb1ba61b/choose_your_own_adventure_online_interactive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cf50c965-9544-41d0-977d-e4f7ea3ccc22/jidezatapufal.pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 15

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off0001f382.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1F382 19412 bytes
SHA-256: 688779e12622dd8a618cdcc8d37d6b7e2a16f9e21d1c03183c2dbffa63ec6cfc
font_00_sfnt_off0000fc4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC4B 7916 bytes
SHA-256: 4fca73d47fa94a6ad668c0f4434483fdc2f54e6be5ae77a011c3735f5dfefd3b
font_01_sfnt_off000110ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110AC 6484 bytes
SHA-256: ee2530f169c748cd60c895f7ba5165278924119268fafb828b8506f09863a3e7
font_02_sfnt_off00012711.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12711 6000 bytes
SHA-256: f85a276e3360af38407e51108d9f929ffbd5ab8406c92cd0c1845e6fde22aa99
font_03_sfnt_off00013b1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B1E 2656 bytes
SHA-256: dbaab8dcf32bfe64cb008f34eb54f5316f62236e8dffe3de49b44225404383a5
font_04_sfnt_off00014620.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14620 4140 bytes
SHA-256: 7073f777ec002e82a856420936458262fa3cc3b4ee0437ed56f01fa51c4379d2
font_05_sfnt_off0001533e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1533E 3048 bytes
SHA-256: 2f58f42410b60611991c12283e964e03297a95500ca09b14f4d605296bc50bc4
font_06_sfnt_off00015f47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15F47 4544 bytes
SHA-256: 53570b1addc227c644bcbe5fafcce3e1ca8a5779b7722260ef5244079f464722
font_07_sfnt_off00016d4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16D4D 2328 bytes
SHA-256: 864cbe2c6973b44d2b71e19ffbffb2328dcb3759b07ceb43c11d5a372fc4956d
font_08_sfnt_off0001780c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1780C 2604 bytes
SHA-256: 0e4b190990c22158f359a0de2485c61736e93a484cfb226f63bccb9bc1da1b2f
font_09_sfnt_off0001832c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1832C 2108 bytes
SHA-256: d117309382da938f7dffedc42f90dd4217b4d540d75629b80669d975ecbc171e
font_10_sfnt_off00018ccb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18CCB 3840 bytes
SHA-256: 5b8e8035f8940535bfb5f3d78de7d5c45dbc51c905faa5d9788b8fc152e96872
font_11_sfnt_off00019ae4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19AE4 4336 bytes
SHA-256: 87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284
font_12_sfnt_off0001a884.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A884 6148 bytes
SHA-256: 149738eb3e1d0bfb4a5732e89a115965e6f0cf3fc4971c694d3ce3619176544d
font_13_sfnt_off0001b86d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B86D 21004 bytes
SHA-256: 611fb3863d990fa6abfae330b562ce4031657d731806d4ed3053ddb83031d961

Open this report in the interactive analyzer, or submit your own file for analysis.