Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfe8625b64d2f116…

MALICIOUS

PDF

64.0 KB Created: 2021-03-18 11:37:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: fb4cbdcb4fb903f2aa543261da0310ba SHA-1: d2b4747c17e7af1580f3d5f26dd23bb09107cfc9 SHA-256: bfe8625b64d2f1164cc5a8a27f5b05d1247a18d5b766ec112eb43a752d611802
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to an accounting and finance PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9729

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/award?keyword=accounting+and+finance+for+non+specialists+10th+edition+pdf PDF link annotation
    • https://s3.amazonaws.com/muvevanepen/co_op_games_for_android_offline.pdfIn PDF document text
    • http://raxewaponoxiv.mygamesonline.org/52824511267.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452152/normal_6031ea55433e1.pdfIn PDF document text
    • https://s3.amazonaws.com/limewub/cpp_industrial_engineering_curriculum_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/zesotat/que_es_educacion_civica_y_su_importancia.pdfIn PDF document text
    • http://podeves.xyz/nail_shops_open_on_sunday_near_meop1nq.pdfIn PDF document text
    • http://womirewuzakuf.sportsontheweb.net/59567918217.pdfIn PDF document text
    • http://nunesop.scienceontheweb.net/kufetezudopobupano.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/74420578763.pdfIn PDF document text
    • http://mumolazesinidix.getenjoyment.net/network_security_free_download.pdfIn PDF document text
    • http://zujiran.iblogger.org/best_early_operating_system_cyberpunk_2077.pdfIn PDF document text
    • http://form-lnstagramverificationbadge.com/sagemcom_fst_5260cv_reviewmv5mo.pdfIn PDF document text
    • http://christinaanddavid2019.com/74127557540c3mo2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4392210/normal_6052dfc88555e.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://6cdb29d4-22ce-4aaf-9e51-562b59d50851.filesusr.com/ugd/1b20fb_3a067a8d38e64489a625cae393c5c833.pdf?index=trueIn PDF document text
    • http://pekipawoj.epizy.com/purpose_of_using_transitions_in_essay_writing.pdfIn PDF document text
    • http://jixonolalosixew.rf.gd/podoxaziluwewu.pdfIn PDF document text
    • http://dewudirana.epizy.com/pdf_to_word_convertor_free_software.pdfIn PDF document text
    • http://sujidise.epizy.com/dahao_embroidery_software.pdfIn PDF document text
    • https://9afb1793-bc57-4514-bb46-74e980466609.filesusr.com/ugd/11f207_76225f82fcd4411fa195c03d4c972f7e.pdf?index=trueIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f263.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF263 5600 bytes
SHA-256: 0a17b18f9576903f224cf7d3ec24f6b0b6f966ec3eb18daea0ea6f6a87fc02a6

Open this report in the interactive analyzer, or submit your own file for analysis.