Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd773f20168231db…

MALICIOUS

PDF

77.9 KB Created: 2020-04-23 21:17:30 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-08
MD5: 5798e4c69f1567a4d2e51a893b424352 SHA-1: de203f9c269e9fb0d3b33b74876a138e906a9c9c SHA-256: cd773f20168231db31d0ed4b83473c29c9b4579bdad65bba084de41718bf8e2c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The primary purpose appears to be directing users to a large collection of other PDF files, likely for SEO manipulation or to host further malicious content. The embedded URL in the document body also leads to one of these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adventuresbyprice.com/uploads/1/3/0/6/130621437/130621437.html#formal+education+meaning+in+marathi PDF link annotation
    • http://airpnv.biz/uploads/1/3/1/4/131406173/bedogedut.pdfIn PDF document text
    • http://twolittlepistols.com/uploads/1/3/0/5/130539091/6cc6319fd99c.pdfIn PDF document text
    • http://rourkelacatholicdiocese.in/uploads/1/3/0/8/130874075/4429745.pdfIn PDF document text
    • http://mypaircommunity.com/uploads/1/3/0/2/130289494/gelemifewos.pdfIn PDF document text
    • http://mmgastore.org/uploads/1/3/0/7/130738622/bigaxowigene-wotesozezaku.pdfIn PDF document text
    • http://crossfitequanimity.com/uploads/1/3/1/3/131381921/a74a0b42ba443.pdfIn PDF document text
    • http://revyouinc.org/uploads/1/3/0/4/130435622/1843596.pdfIn PDF document text
    • http://soberaddictpod.com/uploads/1/3/0/2/130288577/5f5af362.pdfIn PDF document text
    • http://allroundtreeservice.com/uploads/1/3/0/7/130775962/rupisotivezowesi.pdfIn PDF document text
    • http://yogicbrad.com/uploads/1/3/0/5/130589195/6a5084.pdfIn PDF document text
    • http://roussey.org/uploads/1/3/1/3/131398560/8026670.pdfIn PDF document text
    • http://emilyswinford.com/uploads/1/3/1/3/131398259/tibaremiwipa-dexaludenaveko-siripofiza.pdfIn PDF document text
    • http://befreedesignco.com/uploads/1/3/1/4/131452937/9950051.pdfIn PDF document text
    • http://ugrowbc.com/uploads/1/3/0/5/130539408/jijiveduxetuto.pdfIn PDF document text
    • http://noble.sc/uploads/1/3/0/2/130289317/bb3e4f752a2fb1.pdfIn PDF document text
    • http://www.(12In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000922e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x922E 9444 bytes
SHA-256: 9e11a7b808c6f077e77637e615a40b7398075e546a890fa14ee372fee823cb52
font_01_sfnt_off0000abfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xABFA 9280 bytes
SHA-256: f4193a8bc96e3a6168658a60e7e49f502b1118e41981503b2f9b8dacbe9c6510
font_02_sfnt_off0000cd5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCD5F 2648 bytes
SHA-256: 0a4fe7dcdb0aa2c6c804f9ed51c43b45bb0c6e00b970b40d3c653b661882163b
font_03_sfnt_off0000d6cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6CC 2008 bytes
SHA-256: b251e00b4eea5cbc23adf0180395c4102aea23bcfb5d03ea18ed6a7b261a67d7
font_04_sfnt_off0000e0bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE0BB 17104 bytes
SHA-256: ff1af644dc962a5be747194799e0f8bd3d74f1cca38eaba674c55011d626cf09
font_05_sfnt_off0000f987.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF987 15400 bytes
SHA-256: 35b807d5ca6548e1116edbcaf9f9ab8b37c2191b8ebe7723b49708e7851538a2

Open this report in the interactive analyzer, or submit your own file for analysis.