Malicious PDF — malware analysis report

Static analysis result for SHA-256 1916647e1a6456df…

MALICIOUS

PDF

299.1 KB Created: 2022-04-03 18:47:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-22
MD5: 359285e8cb17b2499952879f2df33100 SHA-1: a073ef014efc353c31b5f6fa06f22573c91c8728 SHA-256: 1916647e1a6456dfc5576ac2dfdd90726ef29ace2211a96b9d2438c3e707bbd4
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7534

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=1989+taylor+swift+zip PDF link annotation
    • https://ramojiri.weebly.com/uploads/1/3/4/4/134443871/rakidika-riwexafipirez-xefegivalofodir-xaboperata.pdfIn PDF document text
    • https://zakosolegim.weebly.com/uploads/1/3/5/3/135337695/648911.pdfIn PDF document text
    • https://fupejudesomazi.weebly.com/uploads/1/3/4/1/134108974/3565335.pdfIn PDF document text
    • https://vofirojaj.weebly.com/uploads/1/3/1/6/131637635/kafanewemiz-temovubipi.pdfIn PDF document text
    • https://fenikazegalo.weebly.com/uploads/1/3/1/3/131379965/vavanurekow.pdfIn PDF document text
    • https://mafewesoxadix.weebly.com/uploads/1/3/4/6/134697647/zubefapudabem-repapo-wijolutemok.pdfIn PDF document text
    • https://firebawoba.weebly.com/uploads/1/3/4/6/134659507/44ff40f450903.pdfIn PDF document text
    • https://luxowodadobib.weebly.com/uploads/1/3/5/3/135325591/lofowuju-namigeze-lolutuj.pdfIn PDF document text
    • https://jezogoxus.weebly.com/uploads/1/3/4/4/134402646/mafisabot.pdfIn PDF document text
    • https://duzigolanulemo.weebly.com/uploads/1/3/2/6/132680867/1673292.pdfIn PDF document text
    • https://xoxoxiwozolem.weebly.com/uploads/1/3/0/7/130739626/xixowef_fatarigu_mumuwosomobuk.pdfIn PDF document text
    • https://diwapexag.weebly.com/uploads/1/3/4/4/134484560/88246.pdfIn PDF document text
    • https://vilejote.weebly.com/uploads/1/3/4/6/134629871/xedowibovisim_lepiwoluvune_loriru.pdfIn PDF document text
    • https://wuwesojelure.weebly.com/uploads/1/3/5/9/135973580/rasew.pdfIn PDF document text
    • https://megogolu.weebly.com/uploads/1/3/4/3/134314378/1205437.pdfIn PDF document text
    • https://laniguxademe.weebly.com/uploads/1/3/1/4/131452878/9576044.pdfIn PDF document text
    • https://polalakenasi.weebly.com/uploads/1/3/0/8/130813885/7348881.pdfIn PDF document text
    • https://mojabizozawobe.weebly.com/uploads/1/3/4/6/134699592/zepij-rivutoxivuk-morovolixuvuvaw.pdfIn PDF document text
    • https://zuziraluxir.weebly.com/uploads/1/3/4/8/134899121/xesurejovefi.pdfIn PDF document text
    • https://puvovajol.weebly.com/uploads/1/3/4/0/134040332/9946217.pdfIn PDF document text
    • https://zerakekume.weebly.com/uploads/1/3/0/7/130739742/ribazedela_rabolovimovuso_xunizasefufeb.pdfIn PDF document text
    • https://lumurali.weebly.com/uploads/1/3/4/6/134640239/1083178.pdfIn PDF document text
    • https://jurojapelo.weebly.com/uploads/1/3/4/8/134878956/bifutekov.pdfIn PDF document text
    • https://jipibivit.weebly.com/uploads/1/3/4/0/134012636/vigugudamuj_relina_wiwerorapebab_tosegogorobefex.pdfIn PDF document text
    • https://judurufag.weebly.com/uploads/1/3/4/6/134688768/6125354.pdfIn PDF document text
    • https://tudupumodowi.weebly.com/uploads/1/3/1/4/131406798/39c202fdf815.pdfIn PDF document text
    • https://tijozamuworibop.weebly.com/uploads/1/3/1/6/131607374/5542288.pdfIn PDF document text
    • https://loleruwomelu.weebly.com/uploads/1/3/4/6/134601180/vogafuzavabit.pdfIn PDF document text
    • https://ragaxunuwad.weebly.com/uploads/1/3/1/4/131407405/3997182.pdfIn PDF document text
    • https://xevekefipozi.weebly.com/uploads/1/3/1/4/131406281/3e76a.pdfIn PDF document text
    • https://wepulawako.weebly.com/uploads/1/3/4/0/134096509/3245431.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00043c85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x43C85 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0004549c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4549C 10704 bytes
SHA-256: 43dca843a7e23825a9449c1bc4514b6a5a9a4755a060725bf9559475878083e3
font_02_sfnt_off00046d7e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46D7E 18320 bytes
SHA-256: 50e1460acbcb39f34e9d9ac9fc740d9add4cfc37287bf04feae6a81220ceb1b6

Open this report in the interactive analyzer, or submit your own file for analysis.