Malicious PDF — malware analysis report

Static analysis result for SHA-256 22b38db195741250…

MALICIOUS

PDF

68.7 KB Created: 2021-10-01 20:49:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-03
MD5: da95990645444ce70491f1604892d061 SHA-1: fcc7d8788fa3054901c3f4db00106cd282bd31c9 SHA-256: 22b38db19574125096217a8d8c07cce09f4809d03cdf668d68fd3858c6fe03dd
146 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9965

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 1 text block(s), carries a click-outward action, and is only 68 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://crewmak.ru/uplcv?utm_term=super+mario+64+maker+download+android PDF link annotation
    • http://www.southforconstruction.com/frontend/web/ckfinder/userfiles/files/kuvuzapivafopojipumenevaz.pdfIn PDF document text
    • http://seatraderhk.com/userfiles/57499380262.pdfIn PDF document text
    • http://palyavalaszto.hu/teszt/upload/file/38915377443.pdfIn PDF document text
    • https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615174c9f0b65---nivizawuwejuvaxojo.pdfIn PDF document text
    • http://keramann.ru/uploads/files/68447346713.pdfIn PDF document text
    • https://www.restaurant-latableedevercel.com/ckfinder/userfiles/files/mujibibonugos.pdfIn PDF document text
    • http://aadcnfgl.netsociality.com/upload/files/lufanu.pdfIn PDF document text
    • http://zatuchlina.cz/upload/file/midelifatoso.pdfIn PDF document text
    • http://numismatika-nbkpdy.cz/userfiles/file/83263303470.pdfIn PDF document text
    • https://florissantdesign.nl/docs/Image/file/jaxusipuxojokejokevoxugoz.pdfIn PDF document text
    • http://uptindia.com/newsimages/file///wedavekatometalefep.pdfIn PDF document text
    • http://angarakshaksecurity.com/userfiles/file/6511930007.pdfIn PDF document text
    • http://kaies.net/upfiles/file/16154500636.pdfIn PDF document text
    • https://heks-tech.com/app/webroot/userfiles/files/neniboxejosisegasiga.pdfIn PDF document text
    • https://miaousland.fr/ckfinder/userfiles/files/mugibasazinokaru.pdfIn PDF document text
    • http://women-for-marriage.com/ckfinder/userfiles/files/zibevurixifegapedotugone.pdfIn PDF document text
    • http://jingluo.net/uploadfiles/files/58593575776.pdfIn PDF document text
    • https://tolgyesvolgy.hu/userfiles/file/576686449.pdfIn PDF document text
    • http://whipitleather.com/userfiles/file/75750490308.pdfIn PDF document text
    • http://kustari.net/userfiles/file/zuxisaleseduj.pdfIn PDF document text
    • http://888chji.com/userfiles/files/3164472976.pdfIn PDF document text
    • https://www.burit.net/wp-content/plugins/formcraft/file-upload/server/content/files/1614c26a72a2a8---gimal.pdfIn PDF document text
    • https://ltes.tw-goods.com/UserFiles/files/zuwadogupibeb.pdfIn PDF document text
    • http://hanahana.vn/media/ftp/file/nabesonosinopubadiwari.pdfIn PDF document text
    • http://s292376414.onlinehome.fr/datas/imgmail/file/84887449931.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000af70.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAF70 14504 bytes
SHA-256: 461bd06043e99a485e8ba59139d52ce696653485e0aeedd388dab73674e597d4
font_01_sfnt_off0000d3b3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3B3 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000ebca.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBCA 10888 bytes
SHA-256: 04b4507b3d20e42d6d7d5c8826b7b659a6bbf56700e1eb72db975fb55cc1e8e1

Open this report in the interactive analyzer, or submit your own file for analysis.