Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b064c97314dbbd1…

MALICIOUS

PDF

149.7 KB Created: 2021-03-14 03:02:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 1da2f43e0cff6738af9efa6540a98596 SHA-1: 6b02ebe0143078ce702f17b6b9ab1a556092acb2 SHA-256: 8b064c97314dbbd18fe6e79e0fb710731960d5950507126a9be6263652e510bf
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous external URIs and is flagged as a link farm on disposable hosting, suggesting a malicious intent to redirect users. The ML classifier also strongly indicated maliciousness. While no scripts were explicitly extracted, the presence of embedded URLs and the document's structure point towards a phishing or malware distribution attempt, likely initiated via spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9402

Heuristics 3

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=anthocyanins+biosynthesis+functions+and+applications+pdf PDF link annotation
    • https://wisemawuperu.weebly.com/uploads/1/3/0/7/130738751/nifosebofedagadasi.pdfIn PDF document text
    • https://wakapulexo.weebly.com/uploads/1/3/3/9/133997174/jakowo.pdfIn PDF document text
    • https://gikanirirexenad.weebly.com/uploads/1/3/0/7/130776133/sigakuj_wubuvexawinad_vivematugam_pepadupitepumoz.pdfIn PDF document text
    • https://fozivumi.weebly.com/uploads/1/3/4/7/134761275/jevozuxogi-rapaxexomiri-fidasu-xefubaje.pdfIn PDF document text
    • http://pubggaming.online/xikebumogsa8p.pdfIn PDF document text
    • http://jaxaxanukijomel.22web.org/united_airlines_information.pdfIn PDF document text
    • http://rineset.xyz/wulexitalaroka5tzsr.pdfIn PDF document text
    • https://zogopovedizojux.weebly.com/uploads/1/3/1/4/131408172/jilepetowago.pdfIn PDF document text
    • http://fogugevup.22web.org/tokixewozogasolanomese.pdfIn PDF document text
    • http://sungo1.space/english_grammar_present_perfect_continuous_tense_exercisesk85k5.pdfIn PDF document text
    • https://wufisosudima.weebly.com/uploads/1/3/0/8/130874090/7877679.pdfIn PDF document text
    • http://glossywp.online/7039985118181t6u.pdfIn PDF document text
    • http://collegegraduatecentraldating.com/117735387746u9gs.pdfIn PDF document text
    • https://jototafedapabo.weebly.com/uploads/1/3/1/3/131398279/bcedf58ef260bd.pdfIn PDF document text
    • https://xodefoxewez.weebly.com/uploads/1/3/5/3/135325776/mikovafiki.pdfIn PDF document text
    • http://lovojat.22web.org/lasko_tower_fan_home_depot.pdfIn PDF document text
    • https://ripaduwik.weebly.com/uploads/1/3/5/3/135311581/dunuleliguvitipo.pdfIn PDF document text
    • https://neloramobipetez.weebly.com/uploads/1/3/1/4/131407165/xubalututasiloj.pdfIn PDF document text
    • https://zofoneparadi.weebly.com/uploads/1/3/5/3/135341866/pevazabozosimaridivi.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://puligop.epizy.com/free_responsive_html_css_website_templates.pdfIn PDF document text
    • http://mabobubokinevo.epizy.com/synchronous_and_induction_motors.pdfIn PDF document text
    • http://jilutuve.rf.gd/moog_sub_37_tribute_edition.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00021ce4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21CE4 5380 bytes
SHA-256: d7ecacbf5201e3ea418d32a9be59e9df0d14cb5972576d509ef677d1d2b327ae
font_01_sfnt_off00022f36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22F36 13640 bytes
SHA-256: 292caa62de2db962e747caff68a18a1767b944d41bd551e6f0981fca3f0ff7d4

Open this report in the interactive analyzer, or submit your own file for analysis.