Malicious PDF — malware analysis report

Static analysis result for SHA-256 978c93981e233aad…

MALICIOUS

PDF

20.9 KB Created: 2020-03-23 16:11:39 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-09
MD5: ab4cba36cde600ab54a4bf23b4e96eec SHA-1: ea278f358a7f583f59cc99d7010ed1fdeb691a6a SHA-256: 978c93981e233aad5e4385dc656f2dfd73d5305571c63074f7cb84305df998ea
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF file is identified as malicious by an ML classifier and exhibits characteristics of a phishing lure, including being image-only with a click-outward action. The document body contains a link to 'http://elijahmatthews.com/uploads/1/3/0/8/130813030/130813030.html#los+valores+humanos+para+ni%C3%B1os', which likely leads to a phishing page. The presence of a large number of external PDF links suggests a link farm intended to boost SEO for malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9982

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://elijahmatthews.com/uploads/1/3/0/8/130813030/130813030.html#los+valores+humanos+para+ni%C3%B1os PDF link annotation
    • http://wbcscholarship.com/uploads/1/3/0/6/130605253/92527b18b713.pdfIn PDF document text
    • http://mercedesschools.com/uploads/1/3/0/2/130271085/b7619e.pdfIn PDF document text
    • http://www.brandonsbasketballacademy.com/uploads/1/3/0/3/130379769/fitidijudale_vexipigiregida_fanepimig.pdfIn PDF document text
    • http://mimillari.com/uploads/1/3/0/4/130435846/bowulaw_pilolopikinutan_motimazobolena_ledebe.pdfIn PDF document text
    • http://houseboatrental.com.au/uploads/1/3/0/2/130270743/sawexolozuro.pdfIn PDF document text
    • http://filmmonk.org/uploads/1/3/0/4/130435943/0106288506f2d6d.pdfIn PDF document text
    • http://course-group.com/uploads/1/3/0/2/130289198/towedevezawoxi-zadeguzelep.pdfIn PDF document text
    • http://maximurquhart.com/uploads/1/3/0/6/130620773/4287574.pdfIn PDF document text
    • http://lovetooshopboutique.com/uploads/1/3/0/5/130546237/sixete.pdfIn PDF document text
    • http://www.hcrsolutions.co.uk/uploads/1/3/0/6/130621425/berunije.pdfIn PDF document text
    • http://www.restaurant-loudun.com/uploads/1/3/0/8/130814237/c219760f85.pdfIn PDF document text
    • http://openrave.net/uploads/1/3/0/7/130776592/6507638.pdfIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.