Malicious PDF — malware analysis report

Static analysis result for SHA-256 98953835e204706d…

MALICIOUS

PDF

89.8 KB Created: 2021-02-27 16:46:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 99bfdf592c8d9c4b66731a1f195c4f1c SHA-1: 5182b057ccf8e85c24ecd34c38258acecbff5d7d SHA-256: 98953835e204706db4b4238748249f918428d1de73bcaad6c9b981842430b083
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs, with a high concentration on disposable hosting, indicating a link farm designed to redirect users. The ClamAV detection and ML classifier strongly suggest malicious intent, likely for phishing or malware delivery. Although no scripts were directly extracted, the PDF structure and embedded URIs are indicative of a malicious document, potentially leveraging embedded JavaScript for redirection or further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=pma+2020+monterey PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4449775/normal_601483733e15d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367903/normal_5fd13c082f17c.pdfIn PDF document text
    • http://texoraw.sportsontheweb.net/79982258730.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426257/normal_5fdc0d89b99d8.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369146/normal_6039d8005fec5.pdfIn PDF document text
    • https://cdn.sqhk.co/niripakexad/jajicA3/80570440000.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367952/normal_6033f3c4e008c.pdfIn PDF document text
    • https://cdn.sqhk.co/tudobele/JZFhfgj/bukox.pdfIn PDF document text
    • http://sbrf.link/46168486057jfg0y.pdfIn PDF document text
    • http://chategratis.online/36550659840lufdt.pdfIn PDF document text
    • http://grusha.space/inkscape_adjust_canvas_size_to_objectc9rx1.pdfIn PDF document text
    • https://cdn.sqhk.co/bitomasijelo/6jc3Vha/music_and_lyrics_movie_songs_mp3_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • http://zorijefugixor.atwebpages.com/rode_videomic_pro_battery_change.pdfIn PDF document text
    • http://kulinikono.epizy.com/alternating_current_machines_by_puchstein.pdfIn PDF document text
    • http://gozidonozali.myartsonline.com/rogazitoxixesi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1A4 5000 bytes
SHA-256: 890163d305b24467151804c17c1087df5b9cc13d69d905369fa67afce86f2316
font_01_sfnt_off0000f292.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF292 20800 bytes
SHA-256: 06d0dfe9cc43c835eb4323e0accf9b1ec01e8e82859de0fbddb7825f87188db8
font_02_sfnt_off00011238.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11238 9740 bytes
SHA-256: 46a2d2686bf83c4b73068e9a656909d7ae7cc4dc98a07609409ba797178a1438
font_03_sfnt_off00013568.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13568 11316 bytes
SHA-256: 57a247d9bce3ef7ced524e5689ee165b42f9252c14790dcda59817a4125c4c00

Open this report in the interactive analyzer, or submit your own file for analysis.