Malicious PDF — malware analysis report

Static analysis result for SHA-256 1913e6bb059f0493…

MALICIOUS

PDF

340.2 KB Created: 2022-02-11 18:07:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-22
MD5: c7f10eec9f12739be9e33ec4b79b8e13 SHA-1: 604a71ae1eafe108175e072d39d248a43b3766a5 SHA-256: 1913e6bb059f0493da2e1ad03f6ffd011281976c4796e7bb9aaaf71c4aa1f71f
166 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6817

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wirut.co.za/XSRYdR1H?utm_term=gud+bye+images PDF link annotation
    • http://xsteelstock.com/d/files/darizozifexigu.pdfIn PDF document text
    • https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/161872b0fd98c5---66886241010.pdfIn PDF document text
    • http://conserviabd.com/assets/ckeditor/kcfinder/upload/files/88594921582.pdfIn PDF document text
    • http://321eastern-thailand.com/userfiles/files/visawovanavikeg.pdfIn PDF document text
    • https://mtmnetwork.net/uploadEditor/files/xopawupatekukazilav.pdfIn PDF document text
    • http://prasiddhakhabar.com/assets/kcfinder/upload/files/64222757274.pdfIn PDF document text
    • http://studiotecnicoforace.eu/userfiles/files/jofidogek.pdfIn PDF document text
    • http://deurwater.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611b68d411c19---54037039547.pdfIn PDF document text
    • http://schoonhovensvrouwenkoor.nl/ckfinder/userfiles/files/gujanekibigilet.pdfIn PDF document text
    • https://muzponyde.muzpony.com/obrazki/file/84812419182.pdfIn PDF document text
    • https://assurancemauricie.com/wp-content/plugins/formcraft/file-upload/server/content/files/16126b20545408---97277840384.pdfIn PDF document text
    • https://www.edutechusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/161a739f45ce9e---dojegadokudipoti.pdfIn PDF document text
    • http://alliance-ic.ru/uploads/file/kalozisivofodaxeba.pdfIn PDF document text
    • https://smartcrm.cloud/upload/files/fisusegubokubazabodixij.pdfIn PDF document text
    • http://bentleyplemtech.ru/userfiles/file/vixipuwoxojopavefedaga.pdfIn PDF document text
    • https://dukumanis.com/contents/files/79012693068.pdfIn PDF document text
    • https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/161b4a07d34c82---52150748280.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e66a8285052---vubif.pdfIn PDF document text
    • https://prospr.fr/ckfinder/userfiles/files/95727152788.pdfIn PDF document text
    • http://srihemkuntsahibfgp.org/hemkunt/userfiles/file/4511967711.pdfIn PDF document text
    • http://thejosephinebryantfamily.com/clients/48776/File/gotet.pdfIn PDF document text
    • http://alpanelektrik.com/depo/sayfaresim/file/23068725627.pdfIn PDF document text
    • http://capitolmetrophysicaltherapy.com/userfiles/file/32356083712.pdfIn PDF document text
    • http://tnshoppingbag.com/upfiles/file/65066342307.pdfIn PDF document text
    • http://maciel.renalic.com/integracion2/site/userfiles/file/jexemusufenofebeju.pdfIn PDF document text
    • https://nisseiplastic.com/up_images/exp/files/kodutoteg.pdfIn PDF document text
    • https://flomogroup.com/upload/files/29871593303.pdfIn PDF document text
    • http://sdv.sk/userfiles/articles/file/xikebimidogigaketut.pdfIn PDF document text
    • https://mayersoffice.com/userfiles/file/davibira.pdfIn PDF document text
    • http://www.jw-kids.jp/kcfinder/upload/files/3810130592.pdfIn PDF document text
    • https://socardan.com/userfiles/files/xubujetaborot.pdfIn PDF document text
    • http://smartpaintingplus.com/userfiles/files/73570014940.pdfIn PDF document text
    • https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/7fb2lmt3ru3kdagpnb5joh3cfe/tezefuvetoxudo.pdfIn PDF document text
    • http://maxbrio.kr/files/files/22840053431.pdfIn PDF document text
    • https://franchise-vietnam.com/app/webroot/img/files/runibuwokibedubewapilodo.pdfIn PDF document text
    • http://88cpap.com/userfiles/files/1903162566.pdfIn PDF document text
    • http://aias.pnu.ac.th/ckfinder/userfiles/files/33755142835.pdfIn PDF document text
    • http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/16191fb84b12b8---nujofuta.pdfIn PDF document text
    • http://www.srijonihealinghome.com/fckimages/file/90724213520.pdfIn PDF document text
    • https://balticseaheritage.com/res/wysiwyg/file/gebebubatij.pdfIn PDF document text
    • https://saikekanglun.com/filespath/files/20211016184703.pdfIn PDF document text
    • http://bobas24.pl/Upload/file/vinuzadekusapumusomamufav.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    +1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004e5aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4E5AA 17232 bytes
SHA-256: ac823e4b2e3cc965a8b85b0b8f57c38bab6a782ec90ea97bc9b47bde784ccfd0
font_01_sfnt_off00051264.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x51264 10516 bytes
SHA-256: ef34f956ca46a37c485f9e4d2a04f02f6d3cdc8958f177a68b6fd4d55ba44acd
font_02_sfnt_off00052a26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52A26 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9

Open this report in the interactive analyzer, or submit your own file for analysis.