PDF static analysis report

Static analysis result for SHA-256 ef7f839d77ca178f…

SUSPICIOUS

PDF

34.3 KB Created: 2020-04-10 00:19:11 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-07
MD5: 12a5970434f97fdaf5e288f396743dbf SHA-1: 58b5cc9548aa0ff407679990dfd63d397202ecfb SHA-256: ef7f839d77ca178fa68ebca024da7421b4dbaffdb81100b34fd1a1995630f89c
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains multiple embedded URLs, with the primary one being http://theoriginalslimemat.com/uploads/1/3/1/4/131454049/131454049.html#antique+seth+thomas+mantle+clock. This URL, along with others, suggests a phishing or social engineering attempt, likely to trick users into visiting a compromised or malicious site. The ML classifier strongly flagged this PDF as malicious, supporting the suspicious nature of the embedded content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theoriginalslimemat.com/uploads/1/3/1/4/131454049/131454049.html#antique+seth+thomas+mantle+clock PDF link annotation
    • http://thelunchbox.biz/uploads/1/3/1/4/131407068/vorudaxowa.pdfIn PDF document text
    • http://herbsimples.com/uploads/1/3/0/6/130605084/640712.pdfIn PDF document text
    • http://changemakerstn.org/uploads/1/3/0/5/130545633/6636424.pdfIn PDF document text
    • http://artsandcraft.beer/uploads/1/3/1/4/131410818/sabajitoro_nepulorisi.pdfIn PDF document text
    • http://swellbathrooms.com/uploads/1/3/0/6/130621194/lugonemoru-metavodesuroge.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E06 7900 bytes
SHA-256: a70cfb52c76b8081b8f2fac1823979e8f2f676c40e92ca9ccdf5c811f2d1b306

Open this report in the interactive analyzer, or submit your own file for analysis.