Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbad100f4ec3b3e3…

MALICIOUS

PDF

145.1 KB Created: 2020-03-07 16:45:37 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-09
MD5: e1ad29693bf5159f19f1bb460b0a3282 SHA-1: a775d4896f9a1a8b5370986824f9e54f4d08c8ae SHA-256: cbad100f4ec3b3e32e287be086c0d41e55968e92c08aa49d167d352ccf890d2c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious File

The PDF document contains a large number of external links, many of which are dynamically generated and point to unrelated content, indicating a link farm or SEO abuse tactic. The presence of a 'Visible LOLBin command execution instruction' heuristic firing suggests that the document is designed to execute commands, likely to download and run further malicious payloads. The primary URL identified is http://74-123-78-154.mgwnet.com/uploads/1/3/0/7/130776517/130776517.html#signs+and+symptoms+of+asthma+exacerbation, which is presented as information about asthma symptoms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-78-154.mgwnet.com/uploads/1/3/0/7/130776517/130776517.html#signs+and+symptoms+of+asthma+exacerbation PDF link annotation
    • http://www.cherylthibodeau.com/uploads/1/3/0/6/130604696/gatelovog_mamabitesixovo_kolul_womugixesutati.pdfIn PDF document text
    • http://studiob.agency/uploads/1/3/0/4/130476447/5177399.pdfIn macro / runtime command snippet
    • http://roryward.com/uploads/1/3/0/2/130291485/resagajomuwabuk.pdfIn PDF document text
    • http://slowgrinder.com/uploads/1/3/0/7/130739000/dedanitalovozuzodada.pdfIn PDF document text
    • http://merryleetraum.net/uploads/1/3/0/4/130477566/e903d7cb7a.pdfIn PDF document text
    • http://beginningbosslife.com/uploads/1/3/0/3/130323552/sosase.pdfIn PDF document text
    • http://cupcakesandaliens.com/uploads/1/3/0/5/130588803/4930157.pdfIn PDF document text
    • http://sorteincorporation.co.za/uploads/1/3/0/7/130776891/lojomivagozeveg-fated-palaba-lujugaxu.pdfIn PDF document text
    • http://5-8dublinmiddle.com/uploads/1/3/0/5/130550967/bisawenafadaku.pdfIn PDF document text
    • http://hendersonchristianoutreach.com/uploads/1/3/0/2/130291415/nusizonadewezob.pdfIn PDF document text
    • http://www.murrayforward5.com/uploads/1/3/0/8/130813054/f08cd3ff9615.pdfIn PDF document text
    • http://mta-sts.mail.escapeartistswartown.com/uploads/1/3/0/3/130323761/421238.pdfIn PDF document text
    • http://mta-sts.thaisrussomano.com/uploads/1/3/0/8/130814935/vobibunadog.pdfIn PDF document text
    • http://klawittertransitllc.com/uploads/1/3/0/6/130621209/tobanaro.pdfIn PDF document text
    • http://romboid.pl/uploads/1/3/0/7/130739063/8195655.pdfIn PDF document text
    • http://experiencegrace.net/uploads/1/3/0/4/130490833/nuwukipepa.pdfIn PDF document text
    • http://www.dtboost.com/uploads/1/3/0/7/130738814/9165591.pdfIn PDF document text
    • http://derrickgardnerphotography.com/uploads/1/3/0/3/130379244/685735.pdfIn PDF document text
    • http://www.basicbitcheshealtheearth.com/uploads/1/3/0/7/130740558/panuruxa_fifuropap.pdfIn PDF document text
    • http://betterbartlett.org/uploads/1/3/0/6/130604878/beboduralop.pdfIn PDF document text
    • http://imgmfr.com/uploads/1/3/0/5/130545260/balopig-wunaretot.pdfIn PDF document text
    • http://www.greaterenochgrove.com/uploads/1/3/0/4/130488884/bd09bbe01323.pdfIn PDF document text
    • http://coloniakiters.com/uploads/1/3/0/2/130289427/mezujakakope.pdfIn PDF document text
    • http://fairdebonaire.com/uploads/1/3/0/6/130621176/4514398.pdfIn PDF document text
    • http://blufftonchurch.org/uploads/1/3/0/5/130539215/f5a2d7.pdfIn PDF document text
    • http://www.cherylthibodeau.com/uploads/1/3/0/6/130604In macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001eb18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1EB18 10968 bytes
SHA-256: 6847ba6c011e8c77e43bf84a3e160ff344337320eed7abb66866723bf5d39f58
font_01_sfnt_off0002116f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2116F 3620 bytes
SHA-256: af5d1abf438d1ed0dbbe213e31909cce2043c4a5bbaf1d24522a800f03f33df6
font_02_sfnt_off00021e12.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21E12 16320 bytes
SHA-256: 3714710c508d524414e0dd842408b5ef2283e7cac44fc843bc37d9c0b7b80784

Open this report in the interactive analyzer, or submit your own file for analysis.