Malicious PDF — malware analysis report

Static analysis result for SHA-256 beca4142ea8b2c41…

MALICIOUS

PDF

37.8 KB Created: 2020-03-11 08:52:09 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-09
MD5: a176466bff5762a95f77c93629b03cb3 SHA-1: 128138ef7e018abb020cff885b38f011b325c31b SHA-256: beca4142ea8b2c41555b0f6d22d20b811a05c608dfd74c8a1ff8ddfa68a6aed8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. No scripts were extracted, but the sheer volume of outbound links suggests a delivery or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theovercomersblueprint.com/uploads/1/3/0/2/130270895/130270895.html#levels+of+affective+domain+pdf PDF link annotation
    • http://balkanco.com/uploads/1/3/0/7/130739024/zukife.pdfIn PDF document text
    • http://westernindustrialdistributors.com/uploads/1/3/0/6/130621715/pasap_lefanepipu_risojupexeda.pdfIn PDF document text
    • http://plr4.us/uploads/1/3/0/8/130873850/2886170.pdfIn PDF document text
    • http://touchfromthehartphotography.com/uploads/1/3/0/6/130620395/2b71245c27.pdfIn PDF document text
    • http://www.buildaschoolinindia.com/uploads/1/3/0/8/130814774/bixuvovexovu.pdfIn PDF document text
    • http://www.mooreandord.com/uploads/1/3/0/4/130476135/pafuba_gebatinam_nugogunagum.pdfIn PDF document text
    • http://vikingwarm.com/uploads/1/3/0/5/130551129/bafiwada_miduwegavud.pdfIn PDF document text
    • http://www.fishqueen.com/uploads/1/3/0/6/130640197/wozapub_pulede.pdfIn PDF document text
    • http://merkabaone.com/uploads/1/3/0/4/130483370/galeda_gupemovavu_xobefelajupurim.pdfIn PDF document text
    • http://painfulhip.org/uploads/1/3/0/6/130640092/tirogezixaga.pdfIn PDF document text
    • http://sciencesmartssociety.org/uploads/1/3/0/6/130604934/2f4ea0ca6.pdfIn PDF document text
    • http://terragrocery.com/uploads/1/3/0/7/130775743/pujosam.pdfIn PDF document text
    • http://academictranscripts.com.au/uploads/1/3/0/2/130291724/8613953.pdfIn PDF document text
    • http://madeinlarioja.com/uploads/1/3/0/4/130476266/sopodawuge_lijowami_zodekawojegiz_salekowogiwada.pdfIn PDF document text
    • http://sobroradio.com/uploads/1/3/0/8/130814681/8854283.pdfIn PDF document text
    • http://simplymetering.com/uploads/1/3/0/3/130323291/loluj.pdfIn PDF document text
    • http://mxjoinus.net/uploads/1/3/0/6/130622103/4824575ffec1bf.pdfIn PDF document text
    • http://ececonline.org/uploads/1/3/0/7/130775049/vowij.pdfIn PDF document text
    • http://valdineschroeder.com/uploads/1/3/0/8/130814190/912199a86d866.pdfIn PDF document text
    • http://www.samedicalmonitoring.com/uploads/1/3/0/7/130738836/zalan-gaveboze-xufumigasuruf-mubosazekosis.pdfIn PDF document text
    • http://ergzna.net/uploads/1/3/0/6/130605269/lutizevuvitifudabir.pdfIn PDF document text
    • http://www.habitsforhealthcoaching.com/uploads/1/3/0/7/130775393/konuzumamesumu.pdfIn PDF document text
    • http://www.suavecultureco.com/uploads/1/3/0/2/130289235/866216.pdfIn PDF document text
    • http://www.lanesaesthetics.co.uk/uploads/1/3/0/6/130620483/c0fd03240b96.pdfIn PDF document text
    • http://chinasummercamp.org/uploads/1/3/0/6/130604589/puzobepareg-kajolidobipiw-jisugekigoj-gekodejerotobe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C3A 7432 bytes
SHA-256: d38d839a1cb770f1a254bb9e0cade3251bb74b8f9941f0d35242af569611781e

Open this report in the interactive analyzer, or submit your own file for analysis.