Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5f198bf6e8420b2…

MALICIOUS

PDF

38.9 KB Created: 2020-11-07 23:03:03 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: a0ac599d694aba9d5f4dffa3e2d442d0 SHA-1: 7b9bd16b32fe4759be77da1430c59cad60e7d756 SHA-256: e5f198bf6e8420b29bbbf593a1b1cf99424acafb0c8b63b626aee20e8688bb22
76 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URI pointing to a suspicious domain, identified by the PDF_URI heuristic and flagged by an ML classifier. The document body, though heavily obfuscated, appears to contain the same suspicious URL. This suggests the file is designed to trick users into visiting a malicious website.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/123?keyword=mark+8+29+worksheet+cwv PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/wilugugo/bank_clerk_job_description.pdfIn PDF document text
    • https://s3.amazonaws.com/tenunud/que_es_elasticidad_en_economia.pdfIn PDF document text
    • https://s3.amazonaws.com/tetenifeme/ethnocentrism_vs_cultural_relativism_mcat.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/50a70f0d-c15c-4a9f-a51a-8f70a68a051f/koviwumojovukobutapo.pdfIn PDF document text
    • https://s3.amazonaws.com/bifadiwuwileji/28005093020.pdfIn PDF document text
    • https://s3.amazonaws.com/pisedij/zawemu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1932c8ea-4df5-43d1-bd2f-fc9dbf07a784/vomokegavuwemagiwetalub.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4acfa7de-5373-421c-8df7-b3f5e7bc77b5/41954989032.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/108db070-7717-4a99-a8d3-1cba6032826b/pinellas_county_school_calendar_2019_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/the_blinding_knife_free.pdfIn PDF document text
    • https://s3.amazonaws.com/tetazino/20005712557.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a5c18123-d237-425e-b3f5-b4934845fb4e/bibb_county_georgia_school_calendar_2018-19.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005870.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5870 5556 bytes
SHA-256: a788bd6fbe25e3860c979f4af7e73648b7e245db0086fa0808ecc366ebbee66d
font_01_sfnt_off00006b80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B80 10496 bytes
SHA-256: 715de23d78b9ccdd59aad64d12234ea8b2c73b91aa1127c206cb4cf8a71b9ca3

Open this report in the interactive analyzer, or submit your own file for analysis.