Malicious PDF — malware analysis report

Static analysis result for SHA-256 87522d2ca427c2b3…

MALICIOUS

PDF

98.0 KB Created: 2021-12-07 20:52:02 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-05-05
MD5: 7bddd2cb88a83797b431835195a31b52 SHA-1: ff32e00d1826db86af8b2f28687294acecdb4765 SHA-256: 87522d2ca427c2b3a424e1ec0ef8fcb10abb5d3e909bceb5c25bc7125a23cf9c
74 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0238

Heuristics 4

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • PDF carries website-builder CDN document link farm medium PDF_CDN_PDF_LINK_FARM
    PDF contains many clickable PDF links parked on website-builder CDNs or simple download gateways together with visible ebook, manual, or download lure text. This matches generated SEO document carriers used to route users through untrusted link/download chains; the PDF itself is an inert link carrier.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getpdf.pw/book?res=weby&isbn=9781849681087&kwd=Microsoft%20SharePoint%202010%20Administration%20Cookbook PDF link annotation
    • https://static.s123-cdn-static-d.com/uploads/4659337/normal_61ad774aaad28.pdfIn PDF document text
    • https://static.s123-cdn-static-a.com/uploads/4659566/normal_61ad86c862e35.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4659722/normal_61ae03a9b8c29.pdfIn PDF document text
    • https://files8.webydo.com/9588995/UploadedFiles/7B80D8DF-F8E0-282F-44CE-03EE42A0A6C5.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00012956.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012956.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12956 21820 bytes
SHA-256: b166b8aaf55e775227844a4c13696fd9bfc124386ea812806854525a15173ea5
font_01_sfnt_off00015c0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15C0E 18936 bytes
SHA-256: 5c1be6244be32b457e426672034cfa6244e8e07d325f99ab1f923430fb9a31cf

Open this report in the interactive analyzer, or submit your own file for analysis.