Malicious PDF — malware analysis report

Static analysis result for SHA-256 1919192687d17052…

MALICIOUS

PDF

400.3 KB Created: 2022-04-10 22:51:05 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-22
MD5: d38143b622bec8df26d7475970cb3c99 SHA-1: a6ef2734542daf2cb624e72a406211a7978e8ecd SHA-256: 1919192687d170521300f182c692ccda69112c3b5578837d33231d6b741abc38
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5513

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lovig.co.za/XSRYdR1H?utm_term=outdoor+patio+furniture+parts PDF link annotation
    • https://wifirinopemuv.weebly.com/uploads/1/3/4/7/134762260/85a540ec9d66b09.pdfIn PDF document text
    • https://www.irisgroupbd.com/templateEditor/kcfinder/upload/files/tazasimaduleba.pdfIn PDF document text
    • https://biurodluga.pl/files/files/68850376539.pdfIn PDF document text
    • https://woxujinugav.weebly.com/uploads/1/3/4/3/134305359/076c08134.pdfIn PDF document text
    • https://zoperugojoboriv.weebly.com/uploads/1/3/1/3/131379643/vevozun_mugazatir_digupamenufuto_xasonilo.pdfIn PDF document text
    • https://karujelibofab.weebly.com/uploads/1/3/1/4/131406149/dubamonev.pdfIn PDF document text
    • http://webhoctot.com/app/webroot/uploads/files/45982406228.pdfIn PDF document text
    • https://wspaperbag.com/userfiles/file/92238421945.pdfIn PDF document text
    • https://patawera.weebly.com/uploads/1/3/4/1/134131312/mamujikakok_jewumerexexi.pdfIn PDF document text
    • https://galesarenad.weebly.com/uploads/1/3/4/3/134380117/pozel.pdfIn PDF document text
    • https://vanixegufewip.weebly.com/uploads/1/3/4/5/134511125/6836030.pdfIn PDF document text
    • https://gevoporiw.weebly.com/uploads/1/4/1/3/141306284/9954434.pdfIn PDF document text
    • http://ebrinteractive.com/userfiles/file/28588672078.pdfIn PDF document text
    • https://xafukulirodut.weebly.com/uploads/1/3/1/3/131379356/1644423.pdfIn PDF document text
    • https://vemesefopega.weebly.com/uploads/1/3/4/6/134684253/nurutukamuzina.pdfIn PDF document text
    • https://pigakuri.weebly.com/uploads/1/3/4/6/134684466/e9e6fe0.pdfIn PDF document text
    • https://dawugagulinejud.weebly.com/uploads/1/3/4/3/134368664/9508429.pdfIn PDF document text
    • https://lafasajuju.weebly.com/uploads/1/3/4/0/134017903/sowaterexujowuku.pdfIn PDF document text
    • https://vewenikeluw.weebly.com/uploads/1/3/0/7/130739128/vupirowek.pdfIn PDF document text
    • https://nozezezolakufu.weebly.com/uploads/1/3/2/6/132695232/20001.pdfIn PDF document text
    • https://danovijo.weebly.com/uploads/1/3/4/7/134774389/3317216.pdfIn PDF document text
    • https://vevifogenumij.weebly.com/uploads/1/3/4/6/134626850/34722.pdfIn PDF document text
    • https://sexeduju.weebly.com/uploads/1/3/5/3/135327292/b9d5eb.pdfIn PDF document text
    • https://dexisuliraj.weebly.com/uploads/1/3/5/3/135346252/bazunezeribepew.pdfIn PDF document text
    • http://www.norestim.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16241b0cbb8053---51313638129.pdfIn PDF document text
    • https://zivefujapowebix.weebly.com/uploads/1/4/1/3/141347072/9113869.pdfIn PDF document text
    • https://warefoboba.weebly.com/uploads/1/3/4/6/134669172/3777184.pdfIn PDF document text
    • https://mail.conepe.org.br/public/ckeditor/kcfinder/upload/files/ragaratufinisidunubavefu.pdfIn PDF document text
    • https://poxotedodesogin.weebly.com/uploads/1/3/4/3/134305686/5372525.pdfIn PDF document text
    • https://zoxofaduw.weebly.com/uploads/1/3/2/6/132683138/kikoz.pdfIn PDF document text
    • https://xidumalebuwun.weebly.com/uploads/1/3/4/8/134894794/1260128.pdfIn PDF document text
    • https://zirubofab.weebly.com/uploads/1/4/1/2/141256605/8bf24fac0a6511e.pdfIn PDF document text
    • https://fewegako.weebly.com/uploads/1/3/1/4/131453302/lojeromibamoz_lenapovabagu.pdfIn PDF document text
    • https://mijekuwovosi.weebly.com/uploads/1/3/4/3/134321571/2450088.pdfIn PDF document text
    • https://tumokisomagen.weebly.com/uploads/1/3/4/8/134897409/najubulonejuv.pdfIn PDF document text
    • https://xajevopo.weebly.com/uploads/1/3/2/6/132682124/342048.pdfIn PDF document text
    • http://le-bouquet.be/userfiles/files/najosap.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005d23a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D23A 17836 bytes
SHA-256: 3b4c87d9e07bfe682549ba888131a9831ad8d814b9bdd0c244069c0425369059
font_01_sfnt_off00060106.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60106 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0006191d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6191D 10568 bytes
SHA-256: ac06853edb7041f43c64a5896865f41963ed9af9ec450b4875cd3aa272c57c24

Open this report in the interactive analyzer, or submit your own file for analysis.