Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2a387ccccf1cf6f…

MALICIOUS

PDF

65.4 KB Created: 2021-02-25 10:24:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 6b87eb0c4c2369475425d3ea4cc105e7 SHA-1: b76c80801f5ac80320645749f80b34d5117876e7 SHA-256: e2a387ccccf1cf6f88314bdc5f47e1c8457628f1be85a55334e48acfbde30dd6
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, many pointing to SEO-optimized PDF farms, suggesting a phishing or malware distribution campaign. The primary lure URL, 'https://seumenha.ru/award?keyword=can+you+watch+harry+potter+on+demand', is designed to attract users with a search query. ClamAV and ML classifiers strongly indicate malicious intent, specifically classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9956

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://seumenha.ru/award?keyword=can+you+watch+harry+potter+on+demand PDF link annotation
    • http://mumolazesinidix.getenjoyment.net/sutuwupudeborup.pdfIn PDF document text
    • http://argo-tourism.com/rakomigaterugcqorq.pdfIn PDF document text
    • http://mapotilij.mygamesonline.org/koxifiwev.pdfIn PDF document text
    • http://fotubobuwenapu.scienceontheweb.net/73999087962.pdfIn PDF document text
    • https://xuvakaxatal.weebly.com/uploads/1/3/1/0/131070170/425394f2ccad3.pdfIn PDF document text
    • http://artistichomesolutions.com/gukirekepabarabamtkqtf.pdfIn PDF document text
    • https://mipikarekegimo.weebly.com/uploads/1/3/1/6/131606279/6246832.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/jutenojamega/avoid_tolls_google_maps_android_auto.pdfIn PDF document text
    • https://s3.amazonaws.com/jebokizez/thinkorswim_active_trader_template.pdfIn PDF document text
    • https://s3.amazonaws.com/gavapozalilup/belkin_n300db_manual.pdfIn PDF document text
    • http://zolibexusago.epizy.com/kiss_list_episode_5_palek_answers.pdfIn PDF document text
    • http://jezeladi.rf.gd/fraction_worksheets_for_6th_grade_printable.pdfIn PDF document text
    • https://s3.amazonaws.com/vonuxagupeduze/teguvorewuzidaneforo.pdfIn PDF document text
    • https://s3.amazonaws.com/vavejijitatofu/fovufanapi.pdfIn PDF document text
    • http://tatasixafiwi.epizy.com/29960087856.pdfIn PDF document text
    • http://mukanebesiva.atwebpages.com/will_crunchyroll_get_one_punch_man_season_2.pdfIn PDF document text
    • https://s3.amazonaws.com/dobesogum/viwonomisipebukatopet.pdfIn PDF document text
    • https://s3.amazonaws.com/sazomo/uber_defensive_driving_course_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/janodojivi/exempt_society_size_guide.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df32.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF32 5152 bytes
SHA-256: 021fa8a56e127ba86bb70ec7377b59814522997789323d20e9b298a9cef6ecf0

Open this report in the interactive analyzer, or submit your own file for analysis.