Malicious PDF — malware analysis report

Static analysis result for SHA-256 a156e803dea79065…

MALICIOUS

PDF

102.3 KB Created: 2021-03-24 04:35:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: c777109dbefae58a1a00ab1a98f305e7 SHA-1: 44be40ed6aaad66e0f348944db16548f62fc6fb1 SHA-256: a156e803dea79065a65ef79f9de462ae70daebcd22e1e7bda16c48f8e3ef2550
194 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics and ClamAV, indicating it's a phishing attempt. The document contains a link farm designed to redirect users to potentially malicious content, disguised as a relevant PDF. The primary malicious URL identified is https://botokaw.ru/award?keyword=greenhouse+effect+pdf+in+marathi, which appears to be part of an SEO manipulation scheme to lure victims.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5711

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://botokaw.ru/award?keyword=greenhouse+effect+pdf+in+marathi PDF link annotation
    • https://s3.amazonaws.com/napoledunadigo/toxeliripelatugen.pdfIn PDF document text
    • https://rusajilema.weebly.com/uploads/1/3/4/8/134853265/8529076.pdfIn PDF document text
    • http://cherrypimp.online/how_to_replace_samsung_xpress_c480fw_fuser_unitor5ns.pdfIn PDF document text
    • https://s3.amazonaws.com/lixuduwonifa/rutejebu.pdfIn PDF document text
    • https://tizemafuniture.weebly.com/uploads/1/3/4/6/134636649/xiviremudipiboma.pdfIn PDF document text
    • https://s3.amazonaws.com/luxelula/spoken_english_classes_for_adults_in_nugegoda.pdfIn PDF document text
    • https://s3.amazonaws.com/bubeto/vubawejowuvojefe.pdfIn PDF document text
    • http://cashfree.store/14093578608sjdag.pdfIn PDF document text
    • http://baramijotafexo.mypressonline.com/69588058709.pdfIn PDF document text
    • http://mjawebdesign.net/avatar_google_drive_linkcybwb.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.indictrans.orgIn PDF document text
    • https://6c8027e1-9878-41b3-a9ef-32ba2b6bcd02.filesusr.com/ugd/185811_7c88d9c098ab4cb59b496a7d78f2c262.pdf?index=trueIn PDF document text
    • https://e33362eb-94ba-4427-a888-6f4863169a18.filesusr.com/ugd/36ce96_6117c0841ca14de88e2f5694b3e8c49c.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cbb33a5-1804-4f14-b8a9-cb0a76cafdc0/how_to_change_my_actiontec_router_password.pdfIn PDF document text
    • http://lawesiwewif.onlinewebshop.net/72884219921.pdfIn PDF document text
    • http://xemigososefof.atwebpages.com/zarijeborezamefi.pdfIn PDF document text
    • https://d5cf7a15-73c9-49c9-ad57-d4f0303abb0c.filesusr.com/ugd/0d002d_e78a5743781f4a778d8a7a4ecd9b9f71.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfcc6289-848b-4dcb-a3a2-7b62406cc80c/xoxaxipoladib.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1A5 5392 bytes
SHA-256: e3b660df2a4e97f0603cc010bb462702e0f7bbef52aaaf9ec5c9f1efb8e62e0f
font_01_sfnt_off0000f3cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF3CF 2656 bytes
SHA-256: 1620336da6018abf771a3b64a4739dbc5cc5761e5bcfd31f9568e9163b5e6178
font_02_sfnt_off0000fed4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFED4 6040 bytes
SHA-256: c4bd90921816fba77802d0a65f8766df596e04b22ca065a8ea52a82e4f473321
font_03_sfnt_off0001125d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1125D 3048 bytes
SHA-256: e23308bb06bff427f4fe2d795198e016b2e9db23d45fd702446b15ef1a1323d1
font_04_sfnt_off00011e69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E69 2328 bytes
SHA-256: 6d897259d7ab9db79b0dbb16904cd99ff486aa7f4a475590a5d3e44eab6e0eed
font_05_sfnt_off00012921.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12921 2604 bytes
SHA-256: d4cda5a9ecb2558448f754249352cd4d73a8f7efff03060ee9a54ebf713292d1
font_06_sfnt_off00013437.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13437 2108 bytes
SHA-256: b3976ad28991401f3a7e0d936621f3963ed8fd81aff5bedc9e25cf6548b1959b
font_07_sfnt_off00013e0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13E0B 4336 bytes
SHA-256: 87016e8933cc862d1d188edfbee698abcff8178ed3d6b510b61737ee02f60284
font_08_sfnt_off00014bac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14BAC 10712 bytes
SHA-256: a18484070175de67f9446d528a4e4b105b58d28b306cb68f5b0ee49667c58b0d
font_09_sfnt_off0001706c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1706C 17100 bytes
SHA-256: 0415911e43b8105d8a6199a408195444484b26654c5bad18f23acbbff8687c89

Open this report in the interactive analyzer, or submit your own file for analysis.