Malicious PDF — malware analysis report

Static analysis result for SHA-256 205e3f6329b1f7ea…

MALICIOUS

PDF

491.1 KB Created: 2022-04-14 14:59:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-07-20
MD5: 129f673f12bf2805c22dc3a92646c036 SHA-1: 2e7dcbd5f4c05fcdecd7742260a78f5424c46af2 SHA-256: 205e3f6329b1f7ea724cda9960c605a3533451d56807b07d7a2364e4de5a3c4a
99 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs, with one prominently advertised as a lure for free movie downloads. This strongly suggests a phishing or malware distribution attempt. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment, indicating the file is designed to trick users into visiting malicious sites or downloading further payloads.

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3788

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF advertises pirated movie streaming/download medium PDF_PIRACY_STREAMING_LURE
    PDF rendered text advertises free full-movie streaming or download using piracy-brand names or a 'full movie + download/free/watch' intent phrase — recovered after folding the styled Unicode confusables the campaign uses to hide those keywords from plain-text detection. These are disposable SEO-spam carriers that route users to malvertising, fake-player, and scam pages; the PDF itself is inert.
  • SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
    PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mifuj.co.za/XSRYdR1H?utm_term=full+movies++free+bollywood PDF link annotation
    • https://kuxilididid.weebly.com/uploads/1/3/4/3/134387830/fineza.pdfIn PDF document text
    • http://ineke-ott.nl/keramiek-beelden-imagesfile/64427229773.pdfIn PDF document text
    • https://betijefozivur.weebly.com/uploads/1/3/0/7/130776077/rutiponur_deberivapafeki_zotumove.pdfIn PDF document text
    • https://pudagabofozeru.weebly.com/uploads/1/3/4/3/134333597/gowuwekowira-genel-dasofe-tosusoxo.pdfIn PDF document text
    • https://iwanbim.iwan.co/userfiles/files/dujisipirufubividase.pdfIn PDF document text
    • https://kujepilam.weebly.com/uploads/1/3/5/3/135343620/5601853.pdfIn PDF document text
    • https://sokifavobal.weebly.com/uploads/1/3/4/5/134514189/nedimekilitexevugoso.pdfIn PDF document text
    • https://best-turbos.com/wp-content/plugins/super-forms/uploads/php/files/c4890afd52efa4d547f89c3d0e0c1f0f/tazotukovawadilu.pdfIn PDF document text
    • https://veregatuvodomos.weebly.com/uploads/1/3/3/9/133997599/jijuvajolowameko.pdfIn PDF document text
    • http://bndweb.nl/upload/files/tataxosasevuku.pdfIn PDF document text
    • http://yunnanyingxiang.com/ckfinder/userfiles/files/mupuderumek.pdfIn PDF document text
    • https://raridebaforu.weebly.com/uploads/1/4/1/2/141280626/kesawo.pdfIn PDF document text
    • https://xn--22ck6bdp5cach0mc23a.com/ckfinder/userfiles/files/fivikizavewujafofoner.pdfIn PDF document text
    • http://optikametuje.cz/userfiles/file/46263482748.pdfIn PDF document text
    • https://12shio4.com/contents/files/1349749805.pdfIn PDF document text
    • https://tedebewoxakiko.weebly.com/uploads/1/4/1/2/141255941/zowarijofizesunifu.pdfIn PDF document text
    • http://bosch-elektronarzedzia.pl/catalog/file/4440192481.pdfIn PDF document text
    • http://take114.kr/FileData/ckfinder/files/20220320_E727F47ABA03BCDE.pdfIn PDF document text
    • https://xajasirofoxuki.weebly.com/uploads/1/3/5/3/135330212/biwegawinemukeruz.pdfIn PDF document text
    • http://www.bennex.co.th/assets/kcfinder/upload/files/vemutidewiwikomeni.pdfIn PDF document text
    • http://cctsw.net/whly/up_files/FCK/file/20220405_134735_168.pdfIn PDF document text
    • https://giltmorestukko.hu/ckfinder/userfiles/files/nofaritejox.pdfIn PDF document text
    • https://bokixewabukogu.weebly.com/uploads/1/3/4/3/134341992/3371116.pdfIn PDF document text
    • https://paratokoke.weebly.com/uploads/1/3/0/7/130739311/putopobixifife.pdfIn PDF document text
    • https://jijejadu.weebly.com/uploads/1/3/2/6/132683218/zekegivam.pdfIn PDF document text
    • https://jazuwexakabe.weebly.com/uploads/1/3/2/3/132302764/metevadilofoli.pdfIn PDF document text
    • https://tiselewo.weebly.com/uploads/1/3/1/6/131606631/5cf7a287761.pdfIn PDF document text
    • https://bigifami.weebly.com/uploads/1/3/1/4/131407708/1dae8e4761056.pdfIn PDF document text
    • https://neninexi.weebly.com/uploads/1/3/4/7/134714879/7e3947dadc4.pdfIn PDF document text
    • https://gifarlcm.com/upfiles/editor/files/xurotivilofo.pdfIn PDF document text
    • http://clairerolo.com/userfiles/file/kanozij.pdfIn PDF document text
    • https://lidisujuv.weebly.com/uploads/1/3/4/5/134515282/7077584.pdfIn PDF document text
    • https://mewopaxa.weebly.com/uploads/1/3/4/8/134848883/41a95.pdfIn PDF document text
    • https://zigifivabukom.weebly.com/uploads/1/3/4/4/134460242/cabf5121.pdfIn PDF document text
    • https://ihotel2b.com/upfiles/editor/files/50566557712.pdfIn PDF document text
    • https://maggies-handmade.com/UserFiles/files/tuloditugejope.pdfIn PDF document text
    • https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/cmd6fr1oe4v875ke7c6uq4el9a/93521814148.pdfIn PDF document text
    • http://eszixv.hu/ckfinder/userfiles/files/83986183066.pdfIn PDF document text
    • http://portamarioarchitetto.eu/userfiles/files/80229872573.pdfIn PDF document text
    • http://kytero.com/admin/kcfinder/upload/files/sefewo.pdfIn PDF document text
    • https://robivitoj.weebly.com/uploads/1/3/4/3/134334713/mamagizirisalujim.pdfIn PDF document text
    • https://melz-feu.ru/upload/37229828087.pdfIn PDF document text
    • https://wirukibit.weebly.com/uploads/1/3/0/9/130969322/885008.pdfIn PDF document text
    • https://moolans.com/uploads/files/26552334849.pdfIn PDF document text
    • https://fitejajozifidom.weebly.com/uploads/1/3/0/7/130775998/3906132.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    +4 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00073c44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73C44 10632 bytes
SHA-256: f35a8406c0d3ad1fe3ce0bc38ee3258120fcf91537c8d4e8322de21bf9997f3a
font_01_sfnt_off000754a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x754A2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00076cb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x76CB8 18124 bytes
SHA-256: 89d7021e697bc1ff32ff42723753c2b6662bed97236ec12db8f949de5cf306e0