Malicious PDF — malware analysis report

Static analysis result for SHA-256 f76725f121868866…

MALICIOUS

PDF

67.6 KB Created: 2021-01-06 10:12:06 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: a9fa7564d0af3a5ac3ca5281b1b30615 SHA-1: 8bde390b512312fe52290782091240fc926841ee SHA-256: f76725f121868866ea31e612cfd3909f9ab492da49182f79196f033d80e652ef
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that uses a lure related to 'Bse odisha 10th class science book pdf' to entice users. It contains a high-risk heuristic firing for a redirector link pointing to 'https://trafficel.ru/aws?utm_term=bse+odisha+10th+class+science+book+pdf', which is flagged as a free-download phishing attempt. ClamAV also detected it as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0', indicating a phishing or trojanized PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7994

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=bse+odisha+10th+class+science+book+pdf PDF link annotation
    • https://cdn.sqhk.co/tajiwikiter/jigej44/ninja_blender_cups_canadian_tire.pdfIn PDF document text
    • https://cdn.sqhk.co/zegetaru/cPhfjhc/d_j_music_apps_online.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fekazudabo/the_vatican_tapes_imdb_parents_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/03029eb3-871d-4ddb-bebf-fc5345eb7f92/polaris_2017_rzr_1000_service_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57e29068-41c2-4c43-bbf1-0329c62908e1/66782916087.pdfIn PDF document text
    • https://s3.amazonaws.com/numegubowalonan/73595309078.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7b81cce3-bd39-4328-b843-f7e103b8fd59/bubble_spinner_2_dead_whale.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54e7107d-c10a-4681-b3c1-5a8ab51ef605/munefarikujoxizobupok.pdfIn PDF document text
    • https://s3.amazonaws.com/retobifulipo/nih_policy_manual_6027.pdfIn PDF document text
    • https://s3.amazonaws.com/gelawiweza/82280459662.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e3d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3D6 5596 bytes
SHA-256: 1f3cbd461d94c604bcef734438d5d2192c727297734488f7ef4f42dbfc0c5132
font_01_sfnt_off0000f6d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF6D7 1832 bytes
SHA-256: 1bf39900b6225532f5cfe4e5f84ab3c4c7b0e90638e281f24f415d3fe24ed3f8

Open this report in the interactive analyzer, or submit your own file for analysis.