Malicious PDF — malware analysis report

Static analysis result for SHA-256 811e583dc0b5fe34…

MALICIOUS

PDF

74.4 KB Created: 2021-03-30 14:07:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 0de77094538a5ecaeba9d62cfb71496a SHA-1: 87d8f28f1fb1b3f21ffc0e783195357ee1e3915a SHA-256: 811e583dc0b5fe3409ef236f4ce376f9104dabe5de2e19120d8a96560293f7da
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, many of which point to disposable domains and are flagged as part of a link farm. The ML classifier strongly indicates maliciousness. The document body, though heavily obfuscated, suggests a lure related to a 'bill of sale form', which is a common pretext for phishing or malware delivery. No scripts were extracted, but the presence of numerous suspicious URLs points to a likely attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/123?utm_term=fl+boat+bill+of+sale+form PDF link annotation
    • http://cookwellbakewell.com/wow_affliction_warlock_pve_guideuv7xz.pdfIn PDF document text
    • http://ladyso.ru/33647181346blkaz.pdfIn PDF document text
    • http://fejugutafilevin.scienceontheweb.net/67170047728.pdfIn PDF document text
    • http://secureappeal.com/car-_part_pro_login23u76.pdfIn PDF document text
    • http://bisituz.sportsontheweb.net/ridovetedu.pdfIn PDF document text
    • http://vclean-sale.shop/linksys_extender_re1000_setup_without_cd439s2.pdfIn PDF document text
    • http://ridunculus.com/passing_chords_for_worship_songsmtejx.pdfIn PDF document text
    • http://micrometerdigital.xyz/28288712785omafs.pdfIn PDF document text
    • http://mnatural.space/35217046822zb1e0.pdfIn PDF document text
    • http://static-start.top/kekogzoeyg.pdfIn PDF document text
    • http://zadidibupinumav.22web.org/73173820487.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jidosatikim/labojoreturavo.pdfIn PDF document text
    • https://s3.amazonaws.com/towutoginadivu/hp_officejet_j4680_check_ink_levels.pdfIn PDF document text
    • http://zalowakudedakov.rf.gd/pewixevosujofiloja.pdfIn PDF document text
    • https://s3.amazonaws.com/lakujusitejojet/57733909991.pdfIn PDF document text
    • http://foxivowopejo.rf.gd/29187102044.pdfIn PDF document text
    • https://s3.amazonaws.com/dudigonifu/80621690229.pdfIn PDF document text
    • http://bumezemenunaxiv.epizy.com/tovovajakunetipifu.pdfIn PDF document text
    • https://s3.amazonaws.com/juduk/undertale_genocide_guide_waterfall.pdfIn PDF document text
    • https://6c8027e1-9878-41b3-a9ef-32ba2b6bcd02.filesusr.com/ugd/185811_3e57592c01204fbaa6f26aed1ae49d8f.pdf?index=trueIn PDF document text
    • https://02796127-04ec-4c85-b270-c6f7310ebb18.filesusr.com/ugd/ce0e6d_43beaf0d276b431f96be6906424e04b8.pdf?index=trueIn PDF document text
    • https://ba85394b-11ac-4ca4-926b-74ca936c52e1.filesusr.com/ugd/5ccfc8_1508095dbe4d44139aea79a8c0be2bbc.pdf?index=trueIn PDF document text
    • https://cd70d4e5-4a1a-4071-96d1-f2415ea5ece1.filesusr.com/ugd/7f46b5_d805d3d5e2074ebab02807cb963d71af.pdf?index=trueIn PDF document text
    • http://vufebadavoga.epizy.com/52408094471.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e514.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE514 5008 bytes
SHA-256: 3710cd6ad782507f859a74c670d2e7c163dddd7bb3a2776f08022663af85e669
font_01_sfnt_off0000f60a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF60A 10900 bytes
SHA-256: c99d0fcc7e4ca930e465ff6c49afcb9d7c2434becdb0785a7a6b037655dd497a

Open this report in the interactive analyzer, or submit your own file for analysis.