Malicious PDF — malware analysis report

Static analysis result for SHA-256 be7ed1409e2770fb…

MALICIOUS

PDF

72.8 KB Created: 2021-03-08 08:55:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: b6504d7877f95c803b7dd98251f3556a SHA-1: 6e7cbfa3b308e1f94dec294c42a52d1e7fc27cb9 SHA-256: be7ed1409e2770fbe19c9c7e118c05df198d2a079d8c2f128b38da5285c13f4e
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. It contains numerous external URLs, many hosted on disposable domains, suggesting a link farm or redirection mechanism for phishing or malware delivery. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/strik?utm_term=herbalife+shaker+cup+instructions PDF link annotation
    • http://zathkatow.xyz/cyberpunk_2077_clothing_mods_dont_stackgksl9.pdfIn PDF document text
    • http://yachts-4-sale.com/fisejexupqyl1b.pdfIn PDF document text
    • https://cdn.sqhk.co/kulobibab/idhjhia/gavuxalunelisumofuberoro.pdfIn PDF document text
    • http://harmony-market.ru/jegaluneytt38.pdfIn PDF document text
    • http://dududuw.mypressonline.com/the_book_of_life_part_2_release_date.pdfIn PDF document text
    • https://cdn.sqhk.co/padasagam/sihijSE/tambourine_definition_sentences.pdfIn PDF document text
    • http://goods-amzon.com/genetics_by_gardner_freez42s3.pdfIn PDF document text
    • https://cdn.sqhk.co/tuwagezo/fibhbhe/lakira.pdfIn PDF document text
    • http://dkblogin-de.com/childrens_christmas_story_videojh5ju.pdfIn PDF document text
    • https://cdn.sqhk.co/polopomoset/dhbcLCj/19352343252.pdfIn PDF document text
    • http://hookup756.fun/what_is_the_purpose_of_laws_in_society33ghd.pdfIn PDF document text
    • http://trycabinets.xyz/how_do_you_sign_up_to_make_money_on_tiktokjarq8.pdfIn PDF document text
    • http://jemulobapamiwu.mywebcommunity.org/stopwatch_instructions_reset.pdfIn PDF document text
    • http://ayazshabutdinov.club/long_division_worksheets_7th_grade08koy.pdfIn PDF document text
    • http://kepuxom.mypressonline.com/what_books_are_similar_to_magic_tree_house.pdfIn PDF document text
    • https://cdn.sqhk.co/lelogivotosu/cgjguhc/south_african_national_defence_force_job_opportunities.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nibizuladode.onlinewebshop.net/mathematical_analysis_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3f872a8-cd05-4ca5-8376-70de5c9ee50c/lodivurolapujuremadago.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/eb951e0e-d77f-4121-ad5e-143b00caef08/100_verbos_mas_usados_en_ingles.pdfIn PDF document text
    • http://gakamaxoluzes.atwebpages.com/is_tintern_abbey_in_wales_or_england.pdfIn PDF document text
    • http://zotubune.myartsonline.com/nursing_theories_and_models_hugh_mckenna.pdfIn PDF document text
    • http://rupesujutiwu.myartsonline.com/54480723355.pdfIn PDF document text
    • http://jaxunukologefis.onlinewebshop.net/whats_the_difference_between_sequence_and_chronological_order.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de90.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE90 5268 bytes
SHA-256: e5d8a5886f4e8aaf071347ff3342105553f666084e1287f497601b86fe9efcea
font_01_sfnt_off0000f074.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF074 10960 bytes
SHA-256: 624538af7dcf64f7c68c2e746b3da845439bacf6580ae05344963ace793ba96a

Open this report in the interactive analyzer, or submit your own file for analysis.