Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6650c3296d2bc58…

MALICIOUS

PDF

72.1 KB Created: 2021-03-30 10:15:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 8fbfe51c87001c90e6c495c87fd652f4 SHA-1: 77975649064639b514bece00b0b6e01847eae92d SHA-256: f6650c3296d2bc586cdf0246b3b690541889e54586d091ee824e5f41c60ff9d5
66 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded URLs, with one specifically designed to appear as a search result for a popular app. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a high volume of links to disposable hosting, suggesting a phishing or malware distribution scheme. The ML classifier strongly flags this PDF as malicious, supporting the conclusion that it is used for malicious redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=movie+box+apk+ios+12 PDF link annotation
    • http://xazixovabifin.medianewsonline.com/axis_and_allies_1941_board_game_rules.pdfIn PDF document text
    • http://pusapev.scienceontheweb.net/bcom_law_uj.pdfIn PDF document text
    • http://somubuzesixuwun.getenjoyment.net/44278849697.pdfIn PDF document text
    • http://fanisore.sportsontheweb.net/narubazela.pdfIn PDF document text
    • http://takipibimaxubov.sportsontheweb.net/fofopewonezisivizar.pdfIn PDF document text
    • http://vowujebotoza.mywebcommunity.org/24011938880.pdfIn PDF document text
    • http://fukiwurezopukof.mywebcommunity.org/21716725622.pdfIn PDF document text
    • http://dakisemakegag.sportsontheweb.net/which_cuisinart_air_fryer_is_the_best.pdfIn PDF document text
    • http://vifubavawet.mygamesonline.org/rent_stabilization_lease_rider.pdfIn PDF document text
    • http://bovibuvebus.getenjoyment.net/kamuxalup.pdfIn PDF document text
    • http://tonedomopoja.scienceontheweb.net/rules_for_radicals_math.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/dobesogum/cpm_integrated_math_1_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/kotodur/desifezewemoremuti.pdfIn PDF document text
    • https://s3.amazonaws.com/sazixipame/annotate_programmatically.pdfIn PDF document text
    • http://minivenema.atwebpages.com/meggs_history_of_graphic_design_sixth_edition.pdfIn PDF document text
    • https://67258aaf-84c5-4a88-bfd2-1aa7ddb6c27a.filesusr.com/ugd/850f07_6d11fb2945a24850bedffee31fcd6110.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/legapatatezisa/99790338175.pdfIn PDF document text
    • https://s3.amazonaws.com/jukoxisojow/4414900238.pdfIn PDF document text
    • https://b09d99c6-da67-4e55-b5b3-baceba093817.filesusr.com/ugd/a69c6c_48593014e9d744e79fed4b89bae7b340.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/fofeguj/panasonic_kx-dt333_manual_change_name.pdfIn PDF document text
    • https://507d1b22-ea03-4061-a262-f79425337ca2.filesusr.com/ugd/a374b9_fa056ff8c96d467b8359f0dda44f81f4.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB5D 5204 bytes
SHA-256: 09739abfdfdac813611a89e271c6e0a8aa6eadd1d7aadc55aed7064ad5a2badf
font_01_sfnt_off0000ed41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED41 10656 bytes
SHA-256: 9fb0aeae19375f7eac8783a4ba9344db53f5e5458e5caffd5f34768a624911fc

Open this report in the interactive analyzer, or submit your own file for analysis.