Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6fa815468c69eaf…

MALICIOUS

PDF

60.6 KB Created: 2020-04-10 00:52:09 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-08
MD5: 93e9a46b38b4230f36af68a354cb0ad1 SHA-1: 65f0f22e33d7153a65450fd705e3a1234cd435a5 SHA-256: c6fa815468c69eafb42d67f42c815e6346e98d3c3a9e95270aaa10599b7a9f73
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links to other PDF files hosted across numerous domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The document body text is largely unreadable, but the presence of the URL 'http://myentouragemusic.com/uploads/1/3/1/4/131438729/131438729.html#you+learn+by+living+pdf' suggests a potential lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myentouragemusic.com/uploads/1/3/1/4/131438729/131438729.html#you+learn+by+living+pdf PDF link annotation
    • http://webstersnc.com/uploads/1/3/0/7/130775431/8867705.pdfIn PDF document text
    • http://printalluk.com/uploads/1/3/0/6/130620736/8890169.pdfIn PDF document text
    • http://bitcoinhamster.com/uploads/1/3/0/6/130605203/kibaxujeme.pdfIn PDF document text
    • http://redifinancialservices.com/uploads/1/3/1/0/131069906/7507049.pdfIn PDF document text
    • http://jinty.online/uploads/1/3/1/0/131070476/nusevapokuzosite.pdfIn PDF document text
    • http://sgcinsight.com/uploads/1/3/0/5/130589252/2615590.pdfIn PDF document text
    • http://ipekgurer.com/uploads/1/3/0/8/130874366/zojitovuwuxovubebex.pdfIn PDF document text
    • http://neurosleepcenter.org/uploads/1/3/0/6/130621839/ab53813c.pdfIn PDF document text
    • http://chippewavalleytrailguide.com/uploads/1/3/0/5/130588584/2ecf28e0.pdfIn PDF document text
    • http://scgist.com/uploads/1/3/0/6/130604728/8845930.pdfIn PDF document text
    • http://baroquesaxophone.com/uploads/1/3/0/6/130604226/504295.pdfIn PDF document text
    • http://kaitiakisisters.com/uploads/1/3/0/6/130639373/643643.pdfIn PDF document text
    • http://gallyspromotrophiesandawards.com/uploads/1/3/0/7/130775510/pezutulez.pdfIn PDF document text
    • http://sovonto.com/uploads/1/3/0/7/130775853/wudunorofuse_rajunoru.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009f80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F80 8964 bytes
SHA-256: 9160f05bd8e1688280bf0f4d544af5730ce23b5c6a361967d3d340083d3d752c
font_01_sfnt_off0000c1a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC1A0 3012 bytes
SHA-256: 3786621a70232dbedc177bbdff57111b150460433d7c5439a50018624ba61495
font_02_sfnt_off0000cc2e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC2E 17168 bytes
SHA-256: 4898f435c77757431571a0b36d2d3a6a4ce3710292494908416bdb94ba70ae1f

Open this report in the interactive analyzer, or submit your own file for analysis.