Malicious PDF — malware analysis report

Static analysis result for SHA-256 080e0898b92f7303…

MALICIOUS

PDF

495.4 KB Created: 2022-02-02 08:58:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-21
MD5: 30a25cb92415d60ea5c6ba051a72780d SHA-1: c64f8cdbc145a0f845311fa8e46e733426eb2966 SHA-256: 080e0898b92f7303fb38e6b8c29c513167c5da13a8d52a9559ca10d90196dc0e
136 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3788

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=hipster+guide+to+hanoi PDF link annotation
    • http://hbtsap.com/Upfiles/news/file///zivajovir.pdfIn PDF document text
    • http://nebo52.ru/uploads/files/46115352087.pdfIn PDF document text
    • https://legend-chang.com/UserFiles/files/fitexugetatonirodobulomi.pdfIn PDF document text
    • http://unewstoday.com/task/userimages/file/zaguxiwasefonuwaxun.pdfIn PDF document text
    • http://netcentricnj.com/ckfinder/userfiles/files/tedawizarewoza.pdfIn PDF document text
    • http://smileorganic.net/smileorgfarm/filesupload/File/mogaguzepeg.pdfIn PDF document text
    • https://www.funes.gob.ar/ckfinder/userfiles/files/60413632674.pdfIn PDF document text
    • http://hiroshima-teishaku.com/userfiles/file/movekalepo.pdfIn PDF document text
    • http://thevisionkharj.com/userfiles/files/pikaxejuzojoz.pdfIn PDF document text
    • http://ty-int.com/files/files/nosus.pdfIn PDF document text
    • http://yanlixin.com/UserFiles/file///ralerabotedoxozufodoziwaj.pdfIn PDF document text
    • http://tinhdaurosa.com/Images_upload/files/bifijozalusenis.pdfIn PDF document text
    • http://snieznik.pl/userfiles/file/91759300477.pdfIn PDF document text
    • https://repare-ton-smartphone.com/userfiles/file/26028036540.pdfIn PDF document text
    • http://nickels.design/ckfinder/userfiles/files/kitetoxonigobofizefajow.pdfIn PDF document text
    • https://trisyscom.com/userfiles/file/62097575363.pdfIn PDF document text
    • http://w.scenekunstskolen-efteruddannelsen.dk/ckfinder/userfiles/files/maxebibuzeb.pdfIn PDF document text
    • https://gopherscopes.com/userfiles/file/74990541717.pdfIn PDF document text
    • https://beylikduzutabelaci.com/userfiles/file/35685833612.pdfIn PDF document text
    • http://www.timtransportes.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/161eaab10eb31b---96477665463.pdfIn PDF document text
    • http://ecohost.ru/pics/images/file/dasud.pdfIn PDF document text
    • http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/161a513a1a2ba8---62994765992.pdfIn PDF document text
    • http://wingmanplanningdemo.com/userfiles/files/tafulula.pdfIn PDF document text
    • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/161e51c5fb4837---pupepogamonenetagixe.pdfIn PDF document text
    • http://bephoangdung.vn/uploads/ckfinder/files/89390161749.pdfIn PDF document text
    • http://www.naraihillgolf.com/admin/userfiles/file/69136674022.pdfIn PDF document text
    • https://reifenscho.de/wp-content/plugins/formcraft/file-upload/server/content/files/161b1869f1b31b---fonazofu.pdfIn PDF document text
    • http://raczcsalad.hu/files/nefokefamofe.pdfIn PDF document text
    • https://rainbowfurnitures.com/files/files/lunazoginufokevupijakijog.pdfIn PDF document text
    • http://xn--m1age8bh.xn--p1ai/files/file/gikurov.pdfIn PDF document text
    • http://tyextractor.com/d/files/rimiliduvajozakufipazut.pdfIn PDF document text
    • http://dagmare.de/userfiles/file/30354385184.pdfIn PDF document text
    • https://at1-turbo-j3t.com/contents/files/bojazenijoxaxeluma.pdfIn PDF document text
    • https://suksesunited.com/contents/files/digixodimo.pdfIn PDF document text
    • http://szamosiszerviz.hu/feltoltott/files/74862601234.pdfIn PDF document text
    • http://bachova-terapia.sk/images/file/73642385261.pdfIn PDF document text
    • http://gkz-crimea.ru/userfiles/file/bunofoduxin.pdfIn PDF document text
    • http://vncdata.net/app/webroot/uploads/files/dasakafuretokaweromi.pdfIn PDF document text
    • http://rent-lease-no1.com/userfiles/file/20220125235640.pdfIn PDF document text
    • http://kgmda.com/upload/files/75139216670.pdfIn PDF document text
    • http://www.olympussverige.se/wp-content/plugins/super-forms/uploads/php/files/pd27f0tks7fee66joqhu1mjik1/pekegademo.pdfIn PDF document text
    • https://zoldlepes.hu/userfiles/file/18626608235.pdfIn PDF document text
    • https://securitydm.com/slicice/file/3055016068.pdfIn PDF document text
    • http://thegioimercedes.com/upload/files/risutakureseju.pdfIn PDF document text
    • http://zulassungsservice4you.de/bilder/file/66168479054.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    +4 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00074e4c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x74E4C 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_01_sfnt_off00076567.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76567 18140 bytes
SHA-256: ce3ee684f385e6b5794b1ca67993d3209331ae1f3761aae8d3f0a3ed15650947
font_02_sfnt_off0007950e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7950E 10716 bytes
SHA-256: 8805b5d9cf31b3fed4756ba2d30791a336c0cca5ea425c252fbe135186fd27c7

Open this report in the interactive analyzer, or submit your own file for analysis.