Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc444a259578111c…

MALICIOUS

PDF

23.1 KB Created: 2020-03-21 01:46:25 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2026-05-08
MD5: 64aecde593c7e273dc4a7546573f3b33 SHA-1: 6e92864bf70f4d5c1962af40771761a6bc9e875d SHA-256: fc444a259578111c16c9f85381d5fb169aaaf6c1e5005f504c3d478bbeef0e16
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links, suggesting a link farm or redirection mechanism to host malicious content. The primary URL, http://armortoolcovers.com/uploads/1/3/0/8/130874580/130874580.html#2004+jetta+owners+manual+free, is likely the initial point of contact for the user. No scripts were extracted, but the structure strongly indicates a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://armortoolcovers.com/uploads/1/3/0/8/130874580/130874580.html#2004+jetta+owners+manual+free PDF link annotation
    • http://www.theintegratedclassroom.com/uploads/1/3/0/8/130814676/d48a73e76e.pdfIn PDF document text
    • http://www.yourkitchenpantry.com/uploads/1/3/0/6/130639503/kusowobasoxow.pdfIn PDF document text
    • http://www.vredenburgwoodworking.com/uploads/1/3/0/5/130551718/1650023.pdfIn PDF document text
    • http://susanbrookscommunications.com/uploads/1/3/0/5/130540186/kebon.pdfIn PDF document text
    • http://www.fioruccistore.com/uploads/1/3/0/5/130588269/sawokut.pdfIn PDF document text
    • http://naylorbythewater.net/uploads/1/3/0/6/130604449/fuzewubi.pdfIn PDF document text
    • http://www.harrietbalcombe.com/uploads/1/3/0/5/130546486/nojal.pdfIn PDF document text
    • http://swimmingwithoutborders.org/uploads/1/3/0/7/130739742/5505609.pdfIn PDF document text
    • http://www.pas-de-chat-104119square.com/uploads/1/3/0/5/130589396/340fa0.pdfIn PDF document text
    • http://www.operafriendsforchildren.org/uploads/1/3/0/6/130639397/98533.pdfIn PDF document text
    • http://newedgeroofing.com/uploads/1/3/0/6/130620454/sowimeril-mufenozomuwo-bafad.pdfIn PDF document text
    • http://senatoribrahimhadejia.com/uploads/1/3/0/6/130621472/9168163.pdfIn PDF document text
    • http://redwoodvisualarts.com/uploads/1/3/0/4/130435581/foledosusikasek-kemufa-bodobuzug-sewok.pdfIn PDF document text
    • http://radiancetherapyspa.com/uploads/1/3/0/5/130550660/nufumati-rodepimeguluxod-sepikulexatuga-wixogerefa.pdfIn PDF document text
    • http://bacalandersengarrison.com/uploads/1/3/0/4/130488227/beruvatafexegowela.pdfIn PDF document text
    • http://gslpgtroop147.com/uploads/1/3/0/8/130814353/7950429.pdfIn PDF document text
    • http://molokaishores.info/uploads/1/3/0/6/130639166/peseketuzepojip.pdfIn PDF document text
    • http://tabjs.com/uploads/1/3/0/3/130324126/8367394.pdfIn PDF document text
    • http://www.joanadrussell.com/uploads/1/3/0/9/130969957/1c2436011e5c54.pdfIn PDF document text
    • http://tomsettplumbing.com/uploads/1/3/0/6/130603945/kitugelutuwakule.pdfIn PDF document text
    • http://mail.kidsbehaveaid.com.au/uploads/1/3/0/5/130590596/7159794.pdfIn PDF document text
    • http://www.oiledforlife.org/uploads/1/3/0/9/130969508/5611162.pdfIn PDF document text
    • http://jrsmortgages.com/uploads/1/3/0/5/130588627/fumapunirele.pdfIn PDF document text
    • http://lbtowingservices.com/uploads/1/3/0/7/130740207/pewuboruwexak.pdfIn PDF document text
    • http://johnnyoconnor.com/uploads/1/3/0/6/130621436/3d1a9.pdfIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.