Malicious PDF — malware analysis report

Static analysis result for SHA-256 bdc0f24707e796a0…

MALICIOUS

PDF

85.7 KB Created: 2021-03-20 18:36:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 8a1bece2c4a62a03d9d862b34ef43046 SHA-1: b2522eacb845d3f9fb6d03df1d90cd58fdb5f693 SHA-256: bdc0f24707e796a06e9353c9978ff6e21747c147a9fb58186f70a56c6d61e5e0
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains multiple embedded URLs, with a high concentration of them pointing to disposable or unknown hosting services. The ML classifier strongly flagged this PDF as malicious. The document body, though heavily garbled, contains references to 'wkhtmltopdf' and 'Diccionario de la lengua española', suggesting a lure to a fake resource. The presence of external URIs and the link farm heuristic indicate an attempt to direct users to potentially malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/award?keyword=diccionario+de+la+lengua+espa%25C3%25B1ola+real+academia+espa%25C3%25B1ola+pdf PDF link annotation
    • https://levibezime.weebly.com/uploads/1/3/3/9/133986639/6952125.pdfIn PDF document text
    • http://stakingyfi.com/data_science_jobs_entry_level_in_chennaib6vdc.pdfIn PDF document text
    • https://pemopuxurumolu.weebly.com/uploads/1/3/2/6/132681293/a8c5866f6.pdfIn PDF document text
    • http://vvd.bar/nugowosugexonijinosuw9rpu2.pdfIn PDF document text
    • http://damvglaz2.xyz/sikubarisibul75xrl.pdfIn PDF document text
    • http://ridegibulas.22web.org/xinegusulidomipulul.pdfIn PDF document text
    • http://nasporte1.fun/wirenalit1ifvu.pdfIn PDF document text
    • http://toolsbestpricemicrometer.site/21_day_weight_loss_challenge_appoengp.pdfIn PDF document text
    • https://tewuzafigew.weebly.com/uploads/1/3/4/3/134339743/8497324.pdfIn PDF document text
    • http://opensalon.xyz/quotation_from_platos_apology_38a_the_unexamined_life_is_not_worth_living_brainlyozxo1.pdfIn PDF document text
    • http://50offstore.info/how_to_mount_wd_my_cloud_on_windows_10grakg.pdfIn PDF document text
    • http://blancop.xyz/aov_items_guider15s9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fapomotomojopog.epizy.com/dituxumufaxarev.pdfIn PDF document text
    • https://cd9ed9ec-87d1-42be-9198-0b2de6c1db4d.filesusr.com/ugd/158fb9_80d6691d618a43c7a9582a646f7f333a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pukiza/how_to_use_a_square_knitting_loom.pdfIn PDF document text
    • http://wujamomototugo.epizy.com/autodwg_to_dwg_converter_full.pdfIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/7875937685.pdfIn PDF document text
    • https://1cd0d4d5-11d4-440c-a307-81f73801f601.filesusr.com/ugd/f0e51d_3113c29c069b4ddba93940f3cbe61c80.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/lixasifasi/avg_windows_xp.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f1d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1D6 5684 bytes
SHA-256: ff1f79f81452fa9d75471f8c5cc9b5916e6850e2a5931d5efcf0bfb0116200fd
font_01_sfnt_off000104dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x104DD 14476 bytes
SHA-256: 650a9b41afa70718418866276966a0742c41a320b603f764cbc1914355fda7b1
font_02_sfnt_off00013059.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13059 16204 bytes
SHA-256: 31aa257675234f953cb39254c73a0c002637764ec2691c470e0912636c3685cf

Open this report in the interactive analyzer, or submit your own file for analysis.