PDF malware analysis — malicious · 191ef6a1ec72606a

MALICIOUS

PDF

431.5 KB Created: 2022-04-05 07:27:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-22

MD5: 93d4d06b1636f7cebe4a5a1841a83572 SHA-1: e3cd8e6f12f9508296ca1396a4b105ac9e4dc1a0 SHA-256: 191ef6a1ec72606aa795898922e4cd4a6610d1fe38777c275a6bead2018191cf

136 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.5841

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://colod.co.za/XSRYdR1H?utm_term=part+of+speech+exercise+with+answer PDF link annotation
- https://nogatokeridiku.weebly.com/uploads/1/4/1/2/141254939/4270640.pdfIn PDF document text
- https://katudiwuf.weebly.com/uploads/1/3/6/0/136006549/zarijibagi-nemulimanif.pdfIn PDF document text
- https://mfdesign.hu/files/file/32393956182.pdfIn PDF document text
- http://dpholding.ru/uploads/files/97957935105.pdfIn PDF document text
- https://sejujilebenifej.weebly.com/uploads/1/3/4/8/134886687/8733232.pdfIn PDF document text
- https://gifawinap.weebly.com/uploads/1/3/4/3/134386913/e40b2201f.pdfIn PDF document text
- https://jedufopev.weebly.com/uploads/1/3/4/4/134490540/93e3e1.pdfIn PDF document text
- https://kaxalosenawa.weebly.com/uploads/1/3/4/5/134576513/laxuwexox_dozupog_mejot_zinasubepiwufa.pdfIn PDF document text
- https://kuvutokejutal.weebly.com/uploads/1/3/0/8/130814176/9194858.pdfIn PDF document text
- https://vaviwajefumizin.weebly.com/uploads/1/3/5/3/135348181/wejugaxezebakijosaru.pdfIn PDF document text
- https://nibuzexo.weebly.com/uploads/1/3/4/7/134720699/danexiwabilujedo.pdfIn PDF document text
- https://bozemabaseduwem.weebly.com/uploads/1/3/4/8/134880117/rexesow.pdfIn PDF document text
- https://zivogozupitis.weebly.com/uploads/1/3/1/4/131406352/pufotupo-dadedu.pdfIn PDF document text
- https://ronafipilegov.weebly.com/uploads/1/3/2/6/132681204/9598284.pdfIn PDF document text
- https://xuxuratedagofat.weebly.com/uploads/1/3/4/6/134644764/7588062.pdfIn PDF document text
- https://xojobade.weebly.com/uploads/1/3/4/3/134385351/4301004.pdfIn PDF document text
- https://kinumonitebira.weebly.com/uploads/1/3/4/6/134605003/nalenafuji_fufoxel.pdfIn PDF document text
- http://www.gradur.ba/wp-content/plugins/formcraft/file-upload/server/content/files/16242f1e072e00---43620490023.pdfIn PDF document text
- https://tanasiri.com/piceditor/file/9469929363.pdfIn PDF document text
- http://megamento.com/_UploadFile/Images/file/sorijodenujebolusivatuxol.pdfIn PDF document text
- https://diruwogedow.weebly.com/uploads/1/3/1/3/131382439/pofegapusubuvoranap.pdfIn PDF document text
- https://ralawuxageg.weebly.com/uploads/1/3/4/3/134319431/1444541.pdfIn PDF document text
- https://malashealthcare.com/userfiles/files/kemeralugilusik.pdfIn PDF document text
- https://jexepasevotapak.weebly.com/uploads/1/3/1/6/131606223/zumebo.pdfIn PDF document text
- https://tototatinup.weebly.com/uploads/1/3/4/3/134332383/rinobogazav_lafapafasupoku_juwasozovonozem.pdfIn PDF document text
- https://mawenevemubazu.weebly.com/uploads/1/3/4/4/134402841/rikeriga-napapubobuwita.pdfIn PDF document text
- https://setuzenizenu.weebly.com/uploads/1/3/5/9/135973655/913958.pdfIn PDF document text
- https://zenijubam.weebly.com/uploads/1/3/4/8/134884092/95d31c.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00064bda.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x64BDA	10720 bytes
SHA-256: `4bdc223b7c8af99fd533d73fbf11ae0dd821d13e230af4106b44f68da4e8c2f0`
`font_01_sfnt_off0006648c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6648C	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00067c9e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x67C9E	19444 bytes
SHA-256: `05f1891f2098744c86451ad6d9f356514a6f09b98853d61304eb9a6863d6c600`

Open this report in the interactive analyzer, or submit your own file for analysis.