Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4e0aeb8499d2b51…

MALICIOUS

PDF

27.6 KB Created: 2020-03-25 02:49:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-08
MD5: 6a2e3180a5472fafd7385144ffbaa7a3 SHA-1: b71172173ab131d7141c6d947559210b48c65821 SHA-256: e4e0aeb8499d2b51ffe3409c88ac4891553d5db89cfb9b9e40581030ea00780f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains a single image and a click-outward action pointing to a remote HTML resource. The document body, though heavily obfuscated, contains multiple URLs that appear to be part of a link farm, suggesting a broad distribution effort. The primary attack pattern involves tricking the user into clicking a link that leads to a malicious destination.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://retakedemocracy.com/uploads/1/3/1/0/131070491/131070491.html#finger+pick+guitar+players PDF link annotation
    • http://poulsborvkent.com/uploads/1/3/0/9/130969876/vikegose_doxufarotami_telemixixo_fowaviwafam.pdfIn PDF document text
    • http://prettypersonalities.com/uploads/1/3/0/7/130738696/4703869.pdfIn PDF document text
    • http://atsbo.com/uploads/1/3/0/6/130639393/vurebix-wepububota.pdfIn PDF document text
    • http://www.peaceofmindkindercare.com/uploads/1/3/1/0/131069750/dosadipabisalet.pdfIn PDF document text
    • http://frankbardessono.com/uploads/1/3/0/5/130588595/xugumajuwobo-detebowa-koborawarupado.pdfIn PDF document text
    • http://wssdcsa.com/uploads/1/3/0/9/130969633/259fe53dc4.pdfIn PDF document text
    • http://webdisk.mciea.org/uploads/1/3/0/7/130775166/2765619.pdfIn PDF document text
    • http://revirg.com/uploads/1/3/0/7/130775197/vasofazewom-giwoladekag-bededidufa-toxelekoga.pdfIn PDF document text
    • http://cuttingedgesebringfl.com/uploads/1/3/0/7/130738803/65e29fe3eb940.pdfIn PDF document text
    • http://oasisfurniture.net/uploads/1/3/0/8/130814101/nuligibofafamefunuk.pdfIn PDF document text
    • http://arandonovan.com/uploads/1/3/0/4/130476572/fufelopagewi.pdfIn PDF document text
    • http://britontheroad.com/uploads/1/3/0/3/130313271/9183571.pdfIn PDF document text
    • http://www.lexieflick.com/uploads/1/3/0/5/130539131/retulefuwusa.pdfIn PDF document text
    • http://thehustlernetwork.com/uploads/1/3/0/5/130589420/1589910fce6c0c.pdfIn PDF document text
    • http://andres-historical.com/uploads/1/3/0/6/130620228/5465072.pdfIn PDF document text
    • http://listislanddesign.com/uploads/1/3/0/5/130588512/47f3fe9843a.pdfIn PDF document text
    • http://mireillemanzone.com/uploads/1/3/0/6/130639530/sinurenifupa-vujufadile.pdfIn PDF document text
    • http://davidjiang.us/uploads/1/3/0/7/130775388/8cc4f8c.pdfIn PDF document text
    • http://nccsecec.org/uploads/1/3/0/5/130551536/lapupapotebes.pdfIn PDF document text
    • http://dogtalephoto.com/uploads/1/3/0/8/130813848/580220.pdfIn PDF document text
    • http://drreedallergydoctor.com/uploads/1/3/0/6/130639851/bewoziwopaz_gufanago_nemudu.pdfIn PDF document text
    • http://beautifulsoulspa.com/uploads/1/3/0/6/130620974/fizidujepeniwak.pdfIn PDF document text
    • http://latercomics.com/uploads/1/3/0/6/130640063/levovibararuxefixew.pdfIn PDF document text
    • http://pmaaerospace.net/uploads/1/3/0/3/130313148/vaposotupaga.pdfIn PDF document text
🗂 Part of campaign: deadeyestudios.co 9 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.