Malicious PDF — malware analysis report

Static analysis result for SHA-256 912b2bef0150d8a0…

MALICIOUS

PDF

80.6 KB Created: 2021-03-12 03:02:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: abe4a99235f2431416fd3a3c55bc6615 SHA-1: 234cf6547d1b3c0121c5b76423817486bdf5fe38 SHA-256: 912b2bef0150d8a0f9a29a09191ffc15f983814a4c2835b02740ac1f0f50e0da
66 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with a high-confidence ML classifier flagging it as malicious. One of the primary URLs, 'https://resalured.ru/award?keyword=air+force+x+group+model+paper+pdf+download', suggests a lure related to downloading specific documents. The presence of numerous links, some on disposable hosting, indicates a link farm designed to obscure the true destination or purpose, likely to facilitate the distribution of malware or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://resalured.ru/award?keyword=air+force+x+group+model+paper+pdf+download PDF link annotation
    • http://rivepozepuxar.mywebcommunity.org/schwinn_bike_trailer_costco.pdfIn PDF document text
    • http://pakirekugep.scienceontheweb.net/zibilon.pdfIn PDF document text
    • https://cdn.sqhk.co/gukokefa/oP1oPji/tigaxuloramirigumofe.pdfIn PDF document text
    • http://zagavexakagin.mypressonline.com/list_of_important_days_with_themes_2020.pdfIn PDF document text
    • https://cdn.sqhk.co/wekaradukuve/JEjaidV/five_nights_at_freddy_s_movie_rated_r.pdfIn PDF document text
    • http://wubowobipevoto.mywebcommunity.org/zuduvujavapuzasusifuzow.pdfIn PDF document text
    • https://cdn.sqhk.co/tarekekog/hejaTPt/web_design_online_quote.pdfIn PDF document text
    • http://bumufirila.mygamesonline.org/joker_graphic_novel_harley_quinn.pdfIn PDF document text
    • http://bumawusuka.mypressonline.com/what_is_the_best_survival_knife.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/48772da7-5d9c-464b-8e5e-07e83d34698a/cost_of_washer_bearing_repair.pdfIn PDF document text
    • https://27dd58ca-3bab-4825-b0a2-cb75a9f796de.filesusr.com/ugd/aba4c5_fe3117f9b7a449f8b60987e1122159cb.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/69132444-6821-4f6b-a549-3aa971c690b8/qu_medios_de_comunicacin_oral_conoces.pdfIn PDF document text
    • http://pikubub.onlinewebshop.net/tu_eres_digno_de_gloria_gerry_marquez_letra_y_acordes.pdfIn PDF document text
    • https://6448a590-b571-4b71-a9e4-820b8531b153.filesusr.com/ugd/782be2_aab7c2b37d6a4dcc92de7aa3aee676c0.pdf?index=trueIn PDF document text
    • http://wonanikapudidak.atwebpages.com/jiwunoruvanamiguwezariw.pdfIn PDF document text
    • https://081e7fb2-604d-424b-9b75-a58d54a71a44.filesusr.com/ugd/abd6ea_e04bc849a0174c87ac3573bff0cbe146.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/9927f0b7-1655-477a-a964-3c6c79d42e34/instant_pot_duo_nova_pressure_cooker_recipes.pdfIn PDF document text
    • http://bopewexe.onlinewebshop.net/isometric_to_orthographic_drawing_exercises.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000efa8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEFA8 5248 bytes
SHA-256: 9f3d484daa9f859718ecc5682953d01e565033797d6c4abcc1ccb0bd06bff5dc
font_01_sfnt_off00010171.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10171 10952 bytes
SHA-256: dda390658cfb2d7e2fcf5d5ea1bfb23e7a0a3b270391ac1f4dec2abec79be0e3
font_02_sfnt_off00012645.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12645 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.