Malicious PDF — malware analysis report

Static analysis result for SHA-256 f01ccc9d4938dbe6…

MALICIOUS

PDF

74.6 KB Created: 2021-03-22 08:29:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 56f10b9c40107bcc06ad2ef163b9c4b0 SHA-1: 94caa8d85721aa9ba01c9acc3b53189a599b4f3c SHA-256: f01ccc9d4938dbe64f8825baaf3f84f79afffa1061127f14d79b79bbd8d7d3f1
74 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains heuristics indicating it is a link farm hosted on disposable infrastructure, with one URL specifically mentioning a 'train accident report' and containing urgency language. The ML classifier strongly flagged this PDF as malicious. While no scripts were directly extracted, the structure and embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/123?utm_term=gaisal+train+accident+report PDF link annotation
    • http://vinograd.io/la_riqueza_de_las_naciones_resumen_cortononcd.pdfIn PDF document text
    • http://alphabitx.com/yamaha_ypg-535_review9xn71.pdfIn PDF document text
    • http://sinekem.iblogger.org/1213186853.pdfIn PDF document text
    • http://premial.su/craftsman_25cc_weed_eater_owners_manual8hqq3.pdfIn PDF document text
    • http://online-sistem.site/champion_generator_3500_carburetorhbell.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/dece2937-dd30-4374-8b35-50879679108f/tunajijugigufemubi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dc3495b5-bbfd-4fa5-a6d8-0142ecf978f0/gowugojenewe.pdfIn PDF document text
    • https://s3.amazonaws.com/pezofut/posejudanoxabamal.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/106e375d-4c1a-4a37-b512-b558631298fc/pufuloxujiwunuwagudibaros.pdfIn PDF document text
    • http://kuzoxutinilidog.rf.gd/33076791177.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/72f1ebdc-fffd-42d4-b607-46629cd388ec/korean_from_zero.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d7d0a318-15b0-436d-b76c-5d9054b7de7c/tilidiwivefanenapi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/861cf149-01c1-469e-b906-3d79641d03ca/sharp_ht-sb602_crackling_sound.pdfIn PDF document text
    • https://s3.amazonaws.com/murudute/information_about_great_mathematician_of_india.pdfIn PDF document text
    • https://s3.amazonaws.com/woxorojero/wowodexafizodawivip.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e8bbcfc6-cbb7-4ead-a5cd-68eaf1c1ba8d/vonazavozupanaz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d169526c-924f-46db-9fa9-5201ef1f0f27/hp_laserjet_1320n_driver_filehippo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cfc093ff-fc36-443e-a379-1eeaa6f57259/fundamentals_of_fluid_mechanics_8th_edition.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e74a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE74A 5096 bytes
SHA-256: 250e5c0b3e92c10c5c5c6c4f40b52746ba88062622c34201d00d8f214308f8d0
font_01_sfnt_off0000f8af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF8AF 10764 bytes
SHA-256: 57e46a80daa5b59bc0d09ef28dced2250818425b3ed09214611c085847a721e5

Open this report in the interactive analyzer, or submit your own file for analysis.