Malicious PDF — malware analysis report

Static analysis result for SHA-256 f72f5a2186254fd5…

MALICIOUS

PDF

68.4 KB Created: 2021-04-28 11:06:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: f50fab3a5f54842d59e47050b45cb32f SHA-1: 9f6fef2ded2b91221db1bf34126608b46b58ef8e SHA-256: f72f5a2186254fd5e7eb0793d83824fd70f0241ab21f794709902a7525213b94
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to disposable hosting, and includes a UTM parameter in one URL, indicating a link farm or phishing attempt. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution via these external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8464

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=how+to+use+sentry+safe PDF link annotation
    • http://mufajaku.medianewsonline.com/diferencia_entre_cadena_de_suministro_y_logistica.pdfIn PDF document text
    • https://cdn.sqhk.co/tororukiwuri/PXhihjg/gba._emu_apk_2019.pdfIn PDF document text
    • https://cdn.sqhk.co/pigujoxexate/nDhargf/beginners_movie_free.pdfIn PDF document text
    • http://viwesisikumebi.getenjoyment.net/48743322216.pdfIn PDF document text
    • http://tonemisi.medianewsonline.com/how_to_clean_electrostatic_air_filter.pdfIn PDF document text
    • http://gokojun.scienceontheweb.net/23495798474.pdfIn PDF document text
    • https://cdn.sqhk.co/tosilura/geegiS4/mozimagen.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f2f8a3c9-3ea7-4a25-b7e2-3e2749f32899.filesusr.com/ugd/f0e51d_a68880cdfce940b6bcb7c34a5387ba7b.pdf?index=trueIn PDF document text
    • https://f2d828cf-06d9-46ea-85af-d88b0bc20d44.filesusr.com/ugd/501a20_d34c1e4158cc458dadfda55c6cfd0331.pdf?index=trueIn PDF document text
    • http://noroved.myartsonline.com/billie_jean_chords.pdfIn PDF document text
    • https://8dac4d01-2cd1-45d2-8b5f-6005f802adc9.filesusr.com/ugd/1f96ce_d3ddc7b94b2d413f937286d7f83cb20f.pdf?index=trueIn PDF document text
    • https://29bb9f0a-cb36-4278-8b1c-05d86a2267e4.filesusr.com/ugd/25e746_4a346784aa494b36be9e9d419f5d3303.pdf?index=trueIn PDF document text
    • http://satogitexuvo.myartsonline.com/cae_1_2020.pdfIn PDF document text
    • https://5057b38b-f250-4925-a5fd-2dbc054a2c1f.filesusr.com/ugd/25ee37_7c2f94f7982247aeb06f5382e56bc62d.pdf?index=trueIn PDF document text
    • http://jadivepijuga.myartsonline.com/strategy_and_tactics_magazine.pdfIn PDF document text
    • http://damowepoko.myartsonline.com/bilakirunuligexibapib.pdfIn PDF document text
    • https://68f2566a-c586-4d15-a5d1-3a72044c38f3.filesusr.com/ugd/ecec20_c49ed632eb054f23a7ad9dd1c5ee7f7e.pdf?index=trueIn PDF document text
    • https://7a3463bf-3117-47cc-940f-ad9d50d05675.filesusr.com/ugd/9f2514_f3da616c34284db9a4df07ff36323c6e.pdf?index=trueIn PDF document text
    • http://tosurok.myartsonline.com/irritrol_rd_600_r.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f86a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF86A 4720 bytes
SHA-256: da1b6e6df294f69b79c01baf10d53d46136314836afa14d5963f5b06839bcb18

Open this report in the interactive analyzer, or submit your own file for analysis.