Malicious PDF — malware analysis report

Static analysis result for SHA-256 99e8ae6e1c04ce94…

MALICIOUS

PDF

79.2 KB Created: 2021-07-15 18:04:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-04
MD5: 8dfbdbdf9797aeff1d942ba5e37403a7 SHA-1: ad6d127b0f34ff14b17385f16adb9a4c1dc1edfe SHA-256: 99e8ae6e1c04ce94b6fd8505bb4141a189910e0e263a22523fa7d87e7c280108
76 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by an ML classifier as malicious. It contains an embedded URI that points to a URL, which is a common tactic for phishing or malware distribution. Although the specific URL was labeled as benign, the overall suspicious nature of the PDF and the presence of embedded URIs warrant caution. No scripts were extracted, limiting further analysis of dynamic behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7062

Heuristics 4

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://feedproxy.google.com/~r/sq/ugae/~3/CHqDoFjlE84/square?utm_term=roman+number+of+10000 PDF link annotation
    • https://static1.squarespace.com/static/60bf69b23f3791685666e32d/t/60e93457defa333328ab1700/1625896023421/another_word_for_strong_women.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ec9003b3b63f0898f2e4ae/1626116099397/red_and_white_cabbage_coleslaw.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6c89a2b0b938881bcf91/t/60ee82f56bb0602df2154ac2/1626243829827/oracle_10g_express_edition_tutorial.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ed9d9ac2b60e0ed5b5028c/1626185114571/how_to_fix_corrupted_sd_card_using_android_phone.pdfIn PDF document text
    • https://static1.squarespace.com/static/60bf6cad3a95e91b59aa2418/t/60ee66cf2485902f3e760952/1626236623752/explain_structure_and_function_of_mitochondria.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60e8edda025aa46e30d05c99/1625877978643/63617649305.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aac4dd19f082755c4e5c69/t/60ee4c8a2a4cda17625efebf/1626229898573/vodofurulabowu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c0cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC0CB 16224 bytes
SHA-256: da79484a7f94e028a8871d907a282bdc2df095dfef79f7b1f2af1efeeab75da7
font_01_sfnt_off0000d66c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD66C 16340 bytes
SHA-256: 9e49939f44a09d6faf2334371b865e09adecd87c6f69b263447277eb311f21cf
font_02_sfnt_off000100dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x100DC 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off000118f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x118F3 10432 bytes
SHA-256: d4de4dc3a40262330b189e3e45ee8422b549dfda0328d884e3175cea4a55f76b

Open this report in the interactive analyzer, or submit your own file for analysis.