Malicious PDF — malware analysis report

Static analysis result for SHA-256 f40a8422e99e6758…

MALICIOUS

PDF

42.3 KB Created: 2020-06-24 19:44:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-08
MD5: 8664f51aca039a4699b84e1aab0272d2 SHA-1: 2ae0dfe70ab38a3a91d981aa7a0620b10b81e918 SHA-256: f40a8422e99e67582d79ed2b77ba553bd1488f29f29b680e4900848461cdf517
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous external links, many of which point to other PDF files, suggesting a link farm or redirection mechanism. The document body text explicitly mentions "Microsoft excel 2007 for dummies pdf download" and includes URLs that likely serve as lures for users seeking this content. The presence of a "Visual download / call-to-action button lure" heuristic further supports the idea that the document is designed to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://19j.undesirable.us/uploads/1/3/0/9/130969079/130969079.html#microsoft+excel+2007+for+dummies+pdf+download PDF link annotation
    • http://itsybitsybabygiftmarket.com/uploads/1/3/1/3/131380001/kisupadedup.pdfIn PDF document text
    • http://cssrobotics.com/uploads/1/3/0/6/130620590/lusajas.pdfIn PDF document text
    • http://pelletgrillcentral.com/uploads/1/3/2/3/132303133/xufelajanurenojip.pdfIn PDF document text
    • http://raykakobiella.com/uploads/1/3/2/3/132303001/zasale.pdfIn PDF document text
    • http://xn--rgangsvin-42a.dk/uploads/1/3/0/4/130435820/pavege.pdfIn PDF document text
    • http://mybeautyinkstudio.com/uploads/1/3/1/4/131437296/1507928.pdfIn PDF document text
    • http://hoskinshoops.org/uploads/1/3/0/5/130543682/7868995904.pdfIn PDF document text
    • http://mail.barrow-lane.co.uk/uploads/1/3/1/4/131406802/3930457.pdfIn PDF document text
    • http://russianboutique.co.uk/uploads/1/3/0/7/130739028/7141073.pdfIn PDF document text
    • http://sagaponacksupperclub.com/uploads/1/3/0/7/130775403/759417.pdfIn PDF document text
    • http://africannetwork.org/uploads/1/3/1/6/131637306/pubogamudigosa-gorozilesij-tavujuzafum-rimesojamuvu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65B6 5700 bytes
SHA-256: df1f0bad1cd76c7077d2a6778e87d2f9bf92764c9d8e3335de4cfbc16536a4ce
font_01_sfnt_off0000791e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x791E 10504 bytes
SHA-256: 87d5407f06ec0e14b546b0b1d6a6dc2c031104cff50ce4b3842f0c77656c28ff

Open this report in the interactive analyzer, or submit your own file for analysis.