Malicious PDF — malware analysis report

Static analysis result for SHA-256 18aa9ac974b85cc9…

MALICIOUS

PDF

235.8 KB Created: 2022-04-08 07:48:42 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-09
MD5: 9457e1e16da4111d1121c46ea7ec2f2d SHA-1: 30671d5a807947202396fb890146ba7011364888 SHA-256: 18aa9ac974b85cc947ee430cdbf7fbf784dc85cd4aa4fc31b3e5d1d816bc8834
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6021

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://rajerese.weebly.com/uploads/1/3/4/3/134387708/f46faebc52cb29.pdf In PDF document text
    • https://gixakipero.weebly.com/uploads/1/3/1/4/131412713/7892986.pdfIn PDF document text
    • https://bozuwamit.weebly.com/uploads/1/3/4/5/134527300/jevatobafe_nolakid.pdfIn PDF document text
    • https://hse.tw/upload/file/16248088225.pdfIn PDF document text
    • https://ruwelijowabol.weebly.com/uploads/1/3/4/3/134307429/vuwinad.pdfIn PDF document text
    • http://pmdrecycling.com/wp-content/plugins/formcraft/file-upload/server/content/files/161f862b87089f---24985749698.pdfIn PDF document text
    • https://besajovepew.weebly.com/uploads/1/3/4/6/134633036/3943332.pdfIn PDF document text
    • http://ayurvedabodycure.com/kcfinder/upload/files/2750501235.pdfIn PDF document text
    • https://tagufonatudivar.weebly.com/uploads/1/3/4/6/134609106/mibivegufojik-zigaduki.pdfIn PDF document text
    • https://butevexonukuzi.weebly.com/uploads/1/3/2/6/132681970/turuguwonit_dipisenon.pdfIn PDF document text
    • https://nubazodakop.weebly.com/uploads/1/3/4/8/134850303/domasadose-robasuwubov-nusili-kanuzel.pdfIn PDF document text
    • https://sugogovofel.weebly.com/uploads/1/3/1/0/131069978/9854518.pdfIn PDF document text
    • https://tilifopufobi.weebly.com/uploads/1/3/6/0/136049844/860663.pdfIn PDF document text
    • https://tumozoredupoki.weebly.com/uploads/1/3/0/9/130969837/2f1b46de.pdfIn PDF document text
    • https://bizepusenovub.weebly.com/uploads/1/3/4/5/134509919/5659824.pdfIn PDF document text
    • http://bradzo-ep.com/uploads/files/tafatupugawugumize.pdfIn PDF document text
    • http://careerhack.net/wp-content/plugins/formcraft/file-upload/server/content/files/161fed631f3481---1587708566.pdfIn PDF document text
    • https://vabadagijuruka.weebly.com/uploads/1/3/1/8/131856539/2566361.pdfIn PDF document text
    • http://casaatlantida.com/userfiles/file///77721038197.pdfIn PDF document text
    • https://puvovajol.weebly.com/uploads/1/3/4/0/134040332/d39df82152.pdfIn PDF document text
    • https://administrador.bannik.com/benkio/files/vifatiliduj.pdfIn PDF document text
    • https://rajopolaxobi.weebly.com/uploads/1/3/1/4/131406270/1972999.pdfIn PDF document text
    • https://kafekejanabex.weebly.com/uploads/1/3/2/7/132740445/guwabif_gediginidifaxil_womusu.pdfIn PDF document text
    • https://gusabotod.weebly.com/uploads/1/4/1/3/141307616/2beabc.pdfIn PDF document text
    • https://kutofepiv.weebly.com/uploads/1/3/4/8/134898103/2988317.pdfIn PDF document text
    • https://dalovoxibezovuk.weebly.com/uploads/1/3/4/6/134615649/botado.pdfIn PDF document text
    • https://dolevomebebozap.weebly.com/uploads/1/3/1/6/131636651/zedobabelimi-womisafiviza-vagogaziki.pdfIn PDF document text
    • http://csc-028.com/userfiles/file/20220307100438_b472pl.pdfIn PDF document text
    • https://nsstore.mx/ckeditor/ckfinder/archivossubidos/files/98242595516.pdfIn PDF document text
    • http://www.restaurantegrellada.com/adminc/kcfinder/upload/files/8430396456.pdfIn PDF document text
    • https://mikofamix.weebly.com/uploads/1/3/4/8/134882663/8024158.pdfIn PDF document text
    • https://sarixibaparuve.weebly.com/uploads/1/3/4/3/134382026/3097610.pdfIn PDF document text
    • https://subutadenurafo.weebly.com/uploads/1/3/4/5/134581349/6183ae.pdfIn PDF document text
    • https://mowewudogib.weebly.com/uploads/1/3/5/3/135310369/xoxokojujijiwovit.pdfIn PDF document text
    • https://veriraxitinori.weebly.com/uploads/1/3/5/3/135394444/bapogetuzomi.pdfIn PDF document text
    • https://fozabenuguze.weebly.com/uploads/1/3/4/6/134685739/lederokeg_rosileriri.pdfIn PDF document text
    • https://piguvedulo.weebly.com/uploads/1/3/4/7/134724556/kijiw_liroxokat_zosiw.pdfIn PDF document text
    • https://rekopazexejur.weebly.com/uploads/1/3/4/6/134602417/fowedevonav_jovukinubisev_sivikujavamire.pdfIn PDF document text
    • http://shinaval.ru/userfiles/file/lararurunamamazijisuraz.pdfIn PDF document text
    • https://fixewanum.weebly.com/uploads/1/3/5/3/135309042/rubap.pdfIn PDF document text
    • https://zelikozuka.weebly.com/uploads/1/3/4/5/134594864/kesodoposes_fekufig.pdfIn PDF document text
    • https://xejuzofuna.weebly.com/uploads/1/3/4/8/134858051/1fd546a4.pdfIn PDF document text
    • https://vinamex.info/uploads/news_file/36443399652.pdfIn PDF document text
    • https://lodewaga.weebly.com/uploads/1/3/7/5/137518990/fukuguma.pdfIn PDF document text
    • https://nifiguxo.weebly.com/uploads/1/3/1/3/131398563/giparaf-wefosobivimuk-kekalo-lenajit.pdfIn PDF document text
    • https://yubit.co.za/XSRYdR1H?utm_term=f.+lux+appPDF link annotation
    • https://ruxevikupasej.weebly.com/uploads/1/3/4/6/134663562/rinuli_teberoxomufu_taxab.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    +5 more URL(s)

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002fd6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FD6A 18672 bytes
SHA-256: 7cd00ba344f5ee3c943dcaaf1ca532f4f7b6052570dcd70ed8f0ec59d627b1eb
font_01_sfnt_off000333c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x333C2 25084 bytes
SHA-256: bcdaadae206a86bc58c5166cb8e7b46a0a903ad3c2bab02b68fd9b9fb873c2a2
font_02_sfnt_off00037166.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x37166 9676 bytes
SHA-256: 2f46102a85bfa18ec816c01b2e3dfab54dc7aca489067ca20ccaf9a5a2612a46
font_03_sfnt_off0003868a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3868A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.