Malicious PDF — malware analysis report

Static analysis result for SHA-256 0119aa27f01bc5f6…

MALICIOUS

PDF

246.3 KB Created: 2022-04-06 16:51:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-28
MD5: cd24f1e9535bdb5cd291e4455bbfdbe8 SHA-1: f8b7ebda5b69de778004f6641f9afe79792f413a SHA-256: 0119aa27f01bc5f6a58184f9a10a2365cdb735bfd747ce15614fa7c5ae8a9da3
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6440

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/XSRYdR1H?utm_term=pokemon+tap+280 PDF link annotation
    • https://biwaxosele.weebly.com/uploads/1/3/1/4/131437294/80ee502ebaa.pdfIn PDF document text
    • https://milatesedupodil.weebly.com/uploads/1/3/1/4/131437919/5b724c64.pdfIn PDF document text
    • https://rotasemenedifo.weebly.com/uploads/1/3/5/9/135985080/341d873c542.pdfIn PDF document text
    • https://pamemigewoguvo.weebly.com/uploads/1/3/4/4/134438925/funosulom-pixavin.pdfIn PDF document text
    • https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/162255a378cf1d---44881029321.pdfIn PDF document text
    • https://kekisuganuzab.weebly.com/uploads/1/3/4/7/134721312/wezofazonuvinas.pdfIn PDF document text
    • https://zuwisikap.weebly.com/uploads/1/3/4/4/134441997/mezufub_bojumalajulivuz_tufajipiba_leketegiluwuluz.pdfIn PDF document text
    • https://lasovudevafiwiw.weebly.com/uploads/1/3/4/3/134383328/jijigavekugazalef.pdfIn PDF document text
    • https://www.crosstownnews.in/kcfinder/upload/files/naluzuvopunaroz.pdfIn PDF document text
    • https://xazowivuxef.weebly.com/uploads/1/3/4/5/134513065/bddd0d83cf0d19.pdfIn PDF document text
    • https://pulivaxudifosaj.weebly.com/uploads/1/3/4/2/134235984/sarikugegi.pdfIn PDF document text
    • https://zexibimugurarem.weebly.com/uploads/1/3/5/4/135400238/c8cc0658cc2a03.pdfIn PDF document text
    • https://gekimirit.weebly.com/uploads/1/3/4/7/134700474/joxuvo_disewi_xesotuzebeja.pdfIn PDF document text
    • https://kuvikupomudu.weebly.com/uploads/1/3/4/4/134457818/zozafu_xipexobotepuju_xaledodiwef_girav.pdfIn PDF document text
    • https://mixajogidevo.weebly.com/uploads/1/3/0/9/130969427/5089295.pdfIn PDF document text
    • https://sivavodafewe.weebly.com/uploads/1/3/4/4/134484486/4c3b25e.pdfIn PDF document text
    • https://nodararikerat.weebly.com/uploads/1/3/4/8/134885074/2964293.pdfIn PDF document text
    • https://kimhanh.com.vn/kcfinder/upload/files/vuvakobumejotefawa.pdfIn PDF document text
    • https://tesafugefiwa.weebly.com/uploads/1/3/5/3/135318727/8eb752d57fb0.pdfIn PDF document text
    • https://ruwatija.weebly.com/uploads/1/3/4/8/134846771/8732227.pdfIn PDF document text
    • https://tumenunomowet.weebly.com/uploads/1/3/0/7/130775025/9285113.pdfIn PDF document text
    • https://kijaxupujik.weebly.com/uploads/1/3/2/6/132695195/348c93b149f6.pdfIn PDF document text
    • https://nixogizuriv.weebly.com/uploads/1/3/0/7/130740196/lodebipuxowod-kobog-vuweledomofi.pdfIn PDF document text
    • https://jojixujodu.weebly.com/uploads/1/4/1/2/141251922/4789153.pdfIn PDF document text
    • https://baseparefawufif.weebly.com/uploads/1/3/1/4/131453046/415727391e2c3d.pdfIn PDF document text
    • https://tezewudewitifu.weebly.com/uploads/1/3/4/5/134524208/2a43e222a.pdfIn PDF document text
    • http://hasdeu.md/data/userfiles/files/kikewabavujivejeb.pdfIn PDF document text
    • https://mofumamivuzav.weebly.com/uploads/1/3/1/0/131070192/500824.pdfIn PDF document text
    • https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621c07047a00d---jerorilujugomovuzirajadi.pdfIn PDF document text
    • https://senejudav.weebly.com/uploads/1/3/5/3/135348848/a745bdb0bfcd63.pdfIn PDF document text
    • http://prosefkuchare.cz/userfiles/vejaderaxefafovereru.pdfIn PDF document text
    • https://sulefufevonabu.weebly.com/uploads/1/3/4/3/134363738/1294663.pdfIn PDF document text
    • https://sewemojokevapu.weebly.com/uploads/1/3/4/4/134463988/dajokokiweta.pdfIn PDF document text
    • https://fumunagik.weebly.com/uploads/1/3/4/5/134520136/zedezixepopud.pdfIn PDF document text
    • https://wumemoxononaw.weebly.com/uploads/1/3/4/2/134235532/38a04a4ba2.pdfIn PDF document text
    • https://zikazofikadit.weebly.com/uploads/1/3/0/7/130739129/pugoruxax.pdfIn PDF document text
    • http://kef.org.pk/kcfinder/upload/files/lemivujawamiburilisofom.pdfIn PDF document text
    • https://darelomotusepa.weebly.com/uploads/1/3/7/4/137499239/2421719.pdfIn PDF document text
    • https://gakikodokuni.weebly.com/uploads/1/3/1/8/131857060/e652cd4233a.pdfIn PDF document text
    • https://webmedcentralplus.com/userfiles/file/27038915664.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00036535.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00036535.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00036535.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36535 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00037d4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37D4C 10552 bytes
SHA-256: 6e3b73ce3239185e2bd3c3d54190202700235299c3c17bc02aa04e869e40e100
font_02_sfnt_off00039565.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39565 19376 bytes
SHA-256: 72c7e7fe01870ea72756fbc6fd2a6ea5f9e0e7720bd98f6beb216228bef9cd5e

Open this report in the interactive analyzer, or submit your own file for analysis.