PDF malware analysis — malicious · a85a769a61662ac6

MALICIOUS

PDF

75.0 KB Created: 2021-02-26 07:02:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 6483380365d7536ef353dc7068387086 SHA-1: 1f1bc578a0b882d72c6ae1872ade8d01485f50ae SHA-256: a85a769a61662ac62143a263d80f3ecef941452cc92754a539b135bc00a7b8d5

124 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with one specifically pointing to a link farm on disposable hosting, suggesting a phishing or malware distribution scheme. The document body, though heavily obfuscated, appears to be a lure related to a product search, further supporting the phishing pretext.

Machine Learning

Nyx PDF Classifier malicious score 0.9760

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://seumenha.ru/award?keyword=sennheiser+xsw-d+lavalier+set+digital+lav+wireless+system PDF link annotation
- http://idealicaitaly-ufficiale.site/wevixafasebo3l50r.pdfIn PDF document text
- https://cdn.sqhk.co/bisidilit/3gcpDjb/ice_scream_2_horror_game_download.pdfIn PDF document text
- https://cdn.sqhk.co/jiluputumusi/bjethhI/rudowafozuweluje.pdfIn PDF document text
- https://cdn.sqhk.co/riketumes/1haHLhb/100_doors_floors_escape_level_19_walkthrough.pdfIn PDF document text
- https://cdn.sqhk.co/reriwoduriju/jbhchcK/wafiwiz.pdfIn PDF document text
- http://vesixadaw.22web.org/nabinimurobu.pdfIn PDF document text
- http://tonobipuko.iblogger.org/don_t_starve_early_guide.pdfIn PDF document text
- https://cdn.sqhk.co/torujazelome/cyshej8/line_paint_roller_tray.pdfIn PDF document text
- http://falorilipeb.mywebcommunity.org/rekadidazotixudedo.pdfIn PDF document text
- https://cdn.sqhk.co/javukapegami/Dgcgcji/nhl_scores_today_tsn.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/befafuni/45501838325.pdfIn PDF document text
- http://fogetakid.rf.gd/why_was_the_book_enoch_removed_from_the_bible.pdfIn PDF document text
- http://nodonukebonona.epizy.com/asrock_z77_extreme4_motherboard_manual.pdfIn PDF document text
- https://s3.amazonaws.com/xazarujokemus/fsa_geometry_eoc_review_packet_answers.pdfIn PDF document text
- http://pimuxexud.epizy.com/acdsee_pro_8_crack.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000107dd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x107DD	5696 bytes
SHA-256: `349f5d8f176e366b486d58b10268f226ac6f57167ca8561f568d30be1a97fb7f`

Open this report in the interactive analyzer, or submit your own file for analysis.