Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2836f2e857ef70d…

MALICIOUS

PDF

79.2 KB Created: 2021-03-08 19:31:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 93d4b77f533758c5f0918c06f46d8ca6 SHA-1: aa4f6cfbc8b056834538ca50f5e825b3625a2332 SHA-256: f2836f2e857ef70d2a4ed4eae7419faf94535901bae49fc6d4dc9ff9bd2eafb7
126 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with at least one pointing to a disposable hosting domain, suggesting a link farm or phishing lure. The document body, though heavily obfuscated, contains references to 'wkhtmltopdf' and LaTeX, potentially disguising a malicious payload or redirect.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/aws?utm_term=how+to+write+lambda+in+text+in+latex PDF link annotation
    • https://cdn.sqhk.co/gimexigerub/3mf6V6w/tevatig.pdfIn PDF document text
    • http://jinevul.mygamesonline.org/45689972441.pdfIn PDF document text
    • https://cdn.sqhk.co/torazanopuni/b9gjiiL/human_resource_information_systems_hris_definition.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387232/normal_6033b1d56c214.pdfIn PDF document text
    • https://cdn.sqhk.co/satasevubu/bmifrI6/65434425319.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4447880/normal_601e14423c438.pdfIn PDF document text
    • http://rejasikega.scienceontheweb.net/how_long_to_cancel_a_car_lease_after_signing.pdfIn PDF document text
    • http://koxivesuvif.mypressonline.com/5105317738.pdfIn PDF document text
    • https://cdn.sqhk.co/bikegola/gdQhehf/rigoxatejuwelure.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4382413/normal_600ef2d9974e5.pdfIn PDF document text
    • http://gopidap.scienceontheweb.net/stock_market_lessons_for_beginners.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6e23afab-133c-42d0-a911-4320417c778c/futubalujefemujibetikepel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48f413a5-0e7f-4f18-828f-3131ec24e04b/rejuduret.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ffffd69b-9062-4a7b-9c30-531666ff2359/50357393075.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/246052f3-1d42-412f-b429-64ee92fd0443/most_uncommon_last_names_in_australia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/da55f3ba-bc69-434a-b603-3e38e2564317/what_causes_slow_processing_speed.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3d9d17b1-ad61-4e16-aa70-9ba6150d4106/74131109375.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea9d6fc0-1e86-4d78-8036-246ecbd68e7d/mackie_control_universal_protocol.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/52e03c0b-849b-457a-8b56-0717d0ffec3a/fisher_paykel_dryer_reset_button.pdfIn PDF document text
    • http://sujawokasafu.onlinewebshop.net/snes_game_genie_codes_super_mario_world.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e1fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE1FB 5056 bytes
SHA-256: 0a37fa429633dae6385b09bd52885e83548fd702ba43a1e42d2dfceeee18d19a
font_01_sfnt_off0000f31c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF31C 17748 bytes
SHA-256: 219b775cd03940775e4899d3e1a7fd41e4d9398d30e80e9c3b698a0e95fb0a2a

Open this report in the interactive analyzer, or submit your own file for analysis.