Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b929cfc64a45621…

MALICIOUS

PDF

76.4 KB Created: 2021-01-30 03:42:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: cacf5973dc76dbfc19eba43f7c4f71be SHA-1: 4b7b1aa7ce7a1654b1884af28367017907a67750 SHA-256: 7b929cfc64a456210fd7a2a96e26ec00551565a24f87918ee552798cdd5906cb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document that contains an embedded URL, identified by the PDF_URI heuristic. The ML classifier and ClamAV detection strongly indicate maliciousness. The embedded URL, https://jottigo.ru/123?utm_term=birch+wathen+lenox+uniform, is likely used to redirect the user to a phishing site or download a secondary payload. No scripts were extracted from this sample, but the presence of the URL and the high confidence detections point to a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jottigo.ru/123?utm_term=birch+wathen+lenox+uniform PDF link annotation
    • http://pro-komp-master.website/355257000976mhc3.pdfIn PDF document text
    • https://cdn.sqhk.co/lilapanorup/QAh7Zjh/54609330655.pdfIn PDF document text
    • http://damita.fun/50768147158gawtp.pdfIn PDF document text
    • https://cdn.sqhk.co/kupulifip/exIgjif/funny_email_notification_sounds_download.pdfIn PDF document text
    • http://jobauthor.online/equalizer_music_audio_player_apk9j8ra.pdfIn PDF document text
    • https://cdn.sqhk.co/vadezewe/icRoIbq/incharge_electrical_tauranga.pdfIn PDF document text
    • https://cdn.sqhk.co/xawodoze/kicKuHq/online_shopping_uk_pakistani_clothes.pdfIn PDF document text
    • http://helpcenterbusiness.xyz/jizowixazapuzilarizedanawos.pdfIn PDF document text
    • https://cdn.sqhk.co/tobepeliv/giDhjRe/23353390813.pdfIn PDF document text
    • http://podcard2020.site/at_t_office_hand_meetings_downloaddahs9.pdfIn PDF document text
    • http://djami.ru/foot_cramp_toes_separatelywsr.pdfIn PDF document text
    • http://bestita.space/introduction_to_forensic_anthropology_4th_editione5pxz.pdfIn PDF document text
    • http://mnclassis.org/nomenclatura_inorganica_ejercicios_resueltosd9ph4.pdfIn PDF document text
    • http://znakomstva69.space/fundamentals_of_heat_and_mass_transfer_incropera_7th_edition_solutions_manualvxkev.pdfIn PDF document text
    • http://gratoraama.space/39260409117rweg5.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dazifozixawus/biostar_hi_fi_a70u3p_drivers_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jixerubowi/88814567222.pdfIn PDF document text
    • https://s3.amazonaws.com/paxuvagal/appium_android_automation_framework.pdfIn PDF document text
    • https://s3.amazonaws.com/pasawe/ahimsa_film_songs.pdfIn PDF document text
    • https://s3.amazonaws.com/xupovobejanam/acknowledgement_of_paternity_form_south_carolina.pdfIn PDF document text
    • https://s3.amazonaws.com/kikunojulejuj/88885529341.pdfIn PDF document text
    • https://s3.amazonaws.com/nakuzafol/80900771759.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea4e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA4E 5152 bytes
SHA-256: 5408a0a9e8d887bbf49ff3afadf082ac2670367e91a9a6b5fe063387a9621f8e
font_01_sfnt_off0000fbc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBC7 12064 bytes
SHA-256: 70683046f6dc2f54104414ed5e83f9cc1ef6e8ed43349c1d54867a5cd56118bc

Open this report in the interactive analyzer, or submit your own file for analysis.