Malicious PDF — malware analysis report

Static analysis result for SHA-256 d300745c39ffc8c3…

MALICIOUS

PDF

104.1 KB Created: 2020-04-11 02:54:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-09
MD5: febebeb5255dcecb8b3d577dafb58f55 SHA-1: 53b09584225ee62a7b8e8e03003d41d63f32a0d4 SHA-256: d300745c39ffc8c3cd26f6ef3bde4a276116eb47cbe7601eb2509bfb3da8b65b
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or distribution network. The document body, though heavily obfuscated, contains a URL that aligns with the identified link farm pattern. The primary purpose appears to be directing users to external resources, potentially for SEO manipulation or to serve as a lure for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://7levelselling.stefanaarnio.com/uploads/1/3/0/5/130539660/130539660.html#naranathu+branthan+kavitha PDF link annotation
    • http://lowbudgetlandscaping.com/uploads/1/3/0/7/130739693/abf50434ed59b.pdfIn PDF document text
    • http://lusterglass.com/uploads/1/3/1/4/131454264/2485017.pdfIn PDF document text
    • http://alrcc.net/uploads/1/3/0/3/130323120/49dbb7.pdfIn PDF document text
    • http://hughandleo.com/uploads/1/3/1/4/131438008/2f9dd8.pdfIn PDF document text
    • http://mysciencemedia.com/uploads/1/3/0/6/130621912/3493056.pdfIn PDF document text
    • http://byronbaycompassionatecommunication.com/uploads/1/3/0/9/130969062/rafezekus.pdfIn PDF document text
    • http://togstudios.us/uploads/1/3/1/4/131438234/kifugef.pdfIn PDF document text
    • http://advertisedeming.com/uploads/1/3/0/9/130969059/9536406.pdfIn PDF document text
    • http://funtimefam.com/uploads/1/3/0/5/130551670/pizomarolekuni.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE4A 8564 bytes
SHA-256: 4be4e2bb532e31bcd61ccddf5a96afc4979dbbbbbf768219c6d47fd14bf0a1e6
font_01_sfnt_off0000ff27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF27 16028 bytes
SHA-256: ca889182d22413b1a5b6446cd5d954c095bfc2c8b2fec1022b19199100617195
font_02_sfnt_off00011375.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11375 48496 bytes
SHA-256: bbd76c667a7f71e706f4c33851c88b03c79bebec42bed2a4616129ad41a76eb3

Open this report in the interactive analyzer, or submit your own file for analysis.