Malicious PDF — malware analysis report

Static analysis result for SHA-256 19191e66f89534aa…

MALICIOUS

PDF

101.7 KB Created: 2020-12-03 19:24:26 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-22
MD5: 57b83873fc2e34d5a31ee3eaeb483b7c SHA-1: 4a47bb59eb2f48fae5d1521f6e9cc4b24ab1b01b SHA-256: 19191e66f89534aa9b4098e22654371ee5284887d830187d099a2939e1972611
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/wb?keyword=rmlau%20result%202017%20marksheet PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4445733/normal_5fa75e557e069.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4491927/normal_5fbdba071c757.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://static1.squarespace.com/static/5fbffe9d5687f52b6b7c161f/t/5fc1549e9d79364840bf022c/1606505631021/57587026666.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc10dd588c99b6d37a7fa85/t/5fc783a29dfc2a4045224542/1606910883375/push_and_pop_stack_example.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbe3fdbeaf37e3b64677087/1606303708170/selling_receivables_occurs_when_an_account_becomes_uncollectible.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1162b68612547ed5f39f0/t/5fc8a395d32d012678fea348/1606984597382/fruit_ninja_sword.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c1acc93-860e-4455-b781-77715626c28f/1972_honda_cb175_parts.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1343bd26ff1194f75a191/t/5fc57be461e25426e1f2569b/1606777828858/jumokufuwasawak.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0d3b00b6b03258f353712/t/5fc55ca4e18c5c478eae3b9f/1606769829161/calcium_oxide_philippines.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc28838abaecd33182c940e/t/5fc913ab5cad971a26f2a059/1607013295363/rolukomuze.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc302ce16f6d44b07cc72db/t/5fc5324d18e72e5fdb8016a6/1606758990808/jajog.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbf63f1e6d49a06bb89d6c2/1606378481797/1st_grade_common_core_standards_checklist.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5e3abd80-758e-42d8-8693-91839190972b/72131285730.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbd070e45ca4f79026776aa/1606223631605/still_life_powerpoint.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5db779955c744b55d5a92/t/5fc67bcce18c5c478edb3416/1606843342537/67685524017.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ca78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCA78 31724 bytes
SHA-256: aefb531e5ff2646483511ad594d7dc4ef3a30000a3db2771dcfa495673b27330
font_01_sfnt_off00012dcd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DCD 5400 bytes
SHA-256: e7486ab21a85d2daa2d26de599761dc6aac4cac68143515567ca3c35192dc9e1
font_02_sfnt_off00014003.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14003 10772 bytes
SHA-256: 812e1bdf940b3945fac5769672f23c54f9ddd9fbfe45a2df815267e5f7f1dba4
font_03_sfnt_off000164fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x164FD 16204 bytes
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501
font_04_sfnt_off00017a67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17A67 3620 bytes
SHA-256: 366d4bfa293b389d6bb3fba161487a519cddd98e2097c49cdb02d2a7c391c811

Open this report in the interactive analyzer, or submit your own file for analysis.