Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc965d38b67e8da2…

MALICIOUS

PDF

19.5 KB Created: 2020-04-02 08:50:10 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-08
MD5: 852f47c1cc336bf245be62cc95198505 SHA-1: 9b511ac45b1886e043c95d9e9ba9ef8a696a6f4f SHA-256: dc965d38b67e8da20976ccb77995a3d86d9f891e8b9f57567cc8bc7989682d44
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links, suggesting a link farm designed to distribute malicious content or redirect users to phishing sites. The primary URL, http://manzillions.com/uploads/1/3/0/6/130620387/130620387.html#staar+released+test+5th+grade+math+2018, is likely the initial point of contact for the user. The presence of many similar URLs hosted on various domains reinforces the nature of this attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://manzillions.com/uploads/1/3/0/6/130620387/130620387.html#staar+released+test+5th+grade+math+2018 PDF link annotation
    • http://beyondexpertise.ph/uploads/1/3/0/6/130620267/rafix-fufid-naninoj.pdfIn PDF document text
    • http://thesalondinner.com/uploads/1/3/0/2/130273845/4899658.pdfIn PDF document text
    • http://theatre-at-large.com/uploads/1/3/0/5/130551967/duxusaxevamepenena.pdfIn PDF document text
    • http://mirocku.com/uploads/1/3/0/4/130476981/zadeze_vixowobejon.pdfIn PDF document text
    • http://ramcasinternational.com/uploads/1/3/0/4/130435684/6048877.pdfIn PDF document text
    • http://itsthick.us/uploads/1/3/0/6/130603917/vabopakupo.pdfIn PDF document text
    • http://margoporras.com/uploads/1/3/0/4/130436020/8077029.pdfIn PDF document text
    • http://r-ewolucje.com/uploads/1/3/0/5/130544541/nadiwivawugawoluzom.pdfIn PDF document text
    • http://buildersblitzcapecod.org/uploads/1/3/0/7/130775495/6b62c05f8aec.pdfIn PDF document text
    • http://aurorapaymentprocessing.com/uploads/1/3/0/8/130874395/vudosetewadaduzipe.pdfIn PDF document text
    • http://webmail.lmairtech.com/uploads/1/3/1/3/131398215/zipipibim_digudasado_fologavefaxudor.pdfIn PDF document text
    • http://krogurt.com/uploads/1/3/1/1/131163579/6984074.pdfIn PDF document text
    • http://rayanigrace.com/uploads/1/3/0/6/130621788/ae39566918fa.pdfIn PDF document text
    • http://nostressgardening.com/uploads/1/3/0/9/130969798/dibakefatimitu.pdfIn PDF document text
    • http://tributecinema.com/uploads/1/3/0/8/130874498/8036594.pdfIn PDF document text
    • http://taylorspringdesign.com/uploads/1/3/0/4/130435939/7841939.pdfIn PDF document text
    • http://bigleafmontessori.org/uploads/1/3/0/6/130603904/kediragujutewo_minedumukaba.pdfIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.