Malicious PDF — malware analysis report

Static analysis result for SHA-256 22bc72ff2ca21b09…

MALICIOUS

PDF

294.0 KB Created: 2022-05-02 07:47:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-03
MD5: 9669cced79200777c8bf1eb1e3526686 SHA-1: 574df3736110ce6affcedb1d2c16937fb1195acd SHA-256: 22bc72ff2ca21b09420191b386a6298b4737b0941e1e2dea3150deb6477dad6e
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6855

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fecuq.co.za/XSRYdR1H?utm_term=animated+video+maker+free+software PDF link annotation
    • http://www.kyousei-fukushi.or.jp/system/ckfinder/userfiles/files/3230740148.pdfIn PDF document text
    • https://blgjad.com/upload/files/13803947803.pdfIn PDF document text
    • https://poxawakepuk.weebly.com/uploads/1/3/1/6/131606289/371543.pdfIn PDF document text
    • https://www.amc-lda.com/assets/kcfinder/upload/files/tenidebiwasetatutulovewes.pdfIn PDF document text
    • https://xalidanazate.weebly.com/uploads/1/3/6/0/136082238/xevifawa.pdfIn PDF document text
    • https://fodemisa.weebly.com/uploads/1/4/1/5/141524805/filuxaxoxewed-silamewilat-finimuk-tokivotudomem.pdfIn PDF document text
    • http://tetrafluoro.com/upload/files/wirubaloxidizat.pdfIn PDF document text
    • https://patawera.weebly.com/uploads/1/3/4/1/134131312/sopixojawob.pdfIn PDF document text
    • https://zadefiwexosufe.weebly.com/uploads/1/3/4/6/134634331/zowepebigedufoni.pdfIn PDF document text
    • https://kifakujokaw.weebly.com/uploads/1/3/4/7/134709271/11827.pdfIn PDF document text
    • https://tefawizudarezuf.weebly.com/uploads/1/3/4/6/134640126/80e72fe3a2e.pdfIn PDF document text
    • https://melosuvo.weebly.com/uploads/1/3/4/6/134687736/livuwugibewu.pdfIn PDF document text
    • https://wawurekufa.weebly.com/uploads/1/3/4/3/134322490/linoxis.pdfIn PDF document text
    • https://kexogufonijer.weebly.com/uploads/1/3/4/6/134612909/9aa28f02a.pdfIn PDF document text
    • https://xujeloza.weebly.com/uploads/1/3/4/0/134096435/8823517.pdfIn PDF document text
    • https://tl-systems.hu/files/files/pufazufazovidotomeku.pdfIn PDF document text
    • https://verafilutawus.weebly.com/uploads/1/3/4/5/134597792/2546228.pdfIn PDF document text
    • https://sagotudiwesuw.weebly.com/uploads/1/3/4/3/134340488/xabafifozezig.pdfIn PDF document text
    • https://junimadegerozo.weebly.com/uploads/1/3/4/0/134096607/didis.pdfIn PDF document text
    • https://josabekani.weebly.com/uploads/1/4/1/3/141300095/gudivufuzikoti-dejegedipasaz-kobiferilizi-wirof.pdfIn PDF document text
    • https://davabodijesofid.weebly.com/uploads/1/3/4/4/134474123/2242797.pdfIn PDF document text
    • https://genunilime.weebly.com/uploads/1/3/4/3/134344847/91f514ac.pdfIn PDF document text
    • https://tepaxomiro.weebly.com/uploads/1/3/6/0/136019937/jugaxugosit-bexanituje-rimagarikovez.pdfIn PDF document text
    • https://lopitoxofem.weebly.com/uploads/1/3/4/6/134618260/kubizo_bukijij_rakazidiwililu.pdfIn PDF document text
    • https://romenazojojeles.weebly.com/uploads/1/3/0/7/130775884/sasamibufikabifu.pdfIn PDF document text
    • http://stellarp.com/userfiles/files/xesinovigeze.pdfIn PDF document text
    • http://dansecyr.ca/pdf/file/numiresujavudix.pdfIn PDF document text
    • https://pagajunudew.weebly.com/uploads/1/3/5/9/135992687/vipij_fefer_renijapamowudix_biben.pdfIn PDF document text
    • https://aqua2go.pl/galeria/file/xugotapod.pdfIn PDF document text
    • https://topuwozusap.weebly.com/uploads/1/3/4/8/134869447/f93d23d37e8.pdfIn PDF document text
    • http://www.chinnanaidoo.org.za/kcfinder/upload/files/16019387213.pdfIn PDF document text
    • http://atad.ae/emanager/assets/ckeditor/plugins/kcfinder/upload/files/90846504629.pdfIn PDF document text
    • http://primesystem.kz/app/webroot/js/kcfinder/upload/files/ralifekigiwijalidetu.pdfIn PDF document text
    • https://zidipezes.weebly.com/uploads/1/3/5/3/135314083/malosomexulita.pdfIn PDF document text
    • https://rijagadufe.weebly.com/uploads/1/3/1/6/131606992/sudulapajo-piburubuxavorij.pdfIn PDF document text
    • https://womizanoxagas.weebly.com/uploads/1/3/1/6/131607010/ef7af.pdfIn PDF document text
    • https://zowomotoridaxa.weebly.com/uploads/1/3/1/4/131438570/vevudawijifukiduvuze.pdfIn PDF document text
    • https://dafozadojav.weebly.com/uploads/1/3/4/7/134764431/fugaxijibo-xejane-bubavukamoxopeg-sozag.pdfIn PDF document text
    • https://xodimazu.weebly.com/uploads/1/3/1/4/131408168/3a38211f.pdfIn PDF document text
    • http://zamokugrofa.sk/admin/fckeditor/file/56215597356.pdfIn PDF document text
    • https://lenovajujibina.weebly.com/uploads/1/3/4/8/134875160/76f6ba152bcd4.pdfIn PDF document text
    • https://buxenawemino.weebly.com/uploads/1/3/4/5/134581697/3197619.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    +1 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004296e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4296E 17480 bytes
SHA-256: c9274d75a1d0c1ec01f2a51d7d22a57f0a585e285ff7f124c3ab7e60c32938f7
font_01_sfnt_off00045701.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45701 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00046f18.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46F18 10692 bytes
SHA-256: 07fd59d32c99138ee5c53ab3a0a8e8b06976c981257e594b3c2432a187f9fcd9

Open this report in the interactive analyzer, or submit your own file for analysis.