Malicious PDF — malware analysis report

Static analysis result for SHA-256 292978cd7769bd3e…

MALICIOUS

PDF

277.4 KB Created: 2022-05-06 03:15:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-15
MD5: eae9eafd08b4b2f5f57827aedda87f51 SHA-1: 6ec6121654a54e0904350988603f4201c59d5db3 SHA-256: 292978cd7769bd3e20b5effdb67a6ad5a31ca4e67bc8a9babcf4956cf1b762b6
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6441

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mifuj.co.za/XSRYdR1H?utm_term=turn+up+the+heat+book+pdf+free+online+download+without PDF link annotation
    • http://bdsps.org/slbdavbatala/userfiles/file/seworofubuvakesimu.pdfIn PDF document text
    • https://pojamemurix.weebly.com/uploads/1/3/1/4/131408024/kupiza.pdfIn PDF document text
    • https://baneboveboxov.weebly.com/uploads/1/3/0/7/130775782/61cd2c42.pdfIn PDF document text
    • https://wukodejokiduwe.weebly.com/uploads/1/4/1/4/141431654/de702d65.pdfIn PDF document text
    • https://figapizezedop.weebly.com/uploads/1/3/4/3/134364787/gitipozuwisijew.pdfIn PDF document text
    • https://www.iconcollege.ac.uk/AdminPanel/public/ckeditor/kcfinder/upload/files/62036055395.pdfIn PDF document text
    • https://jisopejoxisa.weebly.com/uploads/1/4/1/2/141254382/2af665a898a9ac7.pdfIn PDF document text
    • https://aquaticlandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/162100a3698f9d---37096357521.pdfIn PDF document text
    • http://luatsubienhoa.com/upload/ck/files/75751840913.pdfIn PDF document text
    • https://ltek.pt/userfiles/file/rutodujefanurimebaki.pdfIn PDF document text
    • http://tdvld.ru/sites/default/files/file/xikepux.pdfIn PDF document text
    • https://al-wesam.com/userfiles/files/61743065382.pdfIn PDF document text
    • http://agapetown.net/ckfinder/userfiles/files/23711407740.pdfIn PDF document text
    • https://bashmak55.ru/ckeditor/kcfinder/upload/files/38759674369.pdfIn PDF document text
    • https://nibalodazapom.weebly.com/uploads/1/4/1/2/141283335/4268701.pdfIn PDF document text
    • http://evevoyance.fr/adh/.-/file/32881282923.pdfIn PDF document text
    • https://adverto.ee/userfiles/file/65139870157.pdfIn PDF document text
    • http://pribatu.todomercedes.com/images/files/dibivunovozemisilanabaxi.pdfIn PDF document text
    • https://siroyensao.com/upload/files/66094090313.pdfIn PDF document text
    • http://gensugroup.com/upload/files/81156410989.pdfIn PDF document text
    • https://legalhouse.pl/files/files/kamojoka.pdfIn PDF document text
    • http://locthanhroyal.com/upload/files/70349230457.pdfIn PDF document text
    • http://checopharma.com/upload/files/labofimekiwibubuki.pdfIn PDF document text
    • http://giaydantuongphongkhach.net/images/news/file/wedekenanuvedoz.pdfIn PDF document text
    • http://www.temaricerca.com/entry2013/admin/ckfinder/userfiles/files/kujefatuvetopugudujive.pdfIn PDF document text
    • http://www.gastroblanik.cz/upload/files/pudufezarifof.pdfIn PDF document text
    • http://air-separation-supplier.com/d/files/gusarebananijedibapi.pdfIn PDF document text
    • https://jejusutib.weebly.com/uploads/1/3/0/7/130740078/3390777.pdfIn PDF document text
    • https://casacresques.cat/uploads/files/wivesinidanudalom.pdfIn PDF document text
    • https://jbdclothiers.net/emailer/userfiles/file/tabovimemixatowutife.pdfIn PDF document text
    • https://simazilojimi.weebly.com/uploads/1/3/5/3/135345327/c7174c4a2ca.pdfIn PDF document text
    • https://clubforeducation.com/FCKeditor/userfiles/file/ruvutajavedamim.pdfIn PDF document text
    • https://gedayapi.com/userfiles/file/xixexawi.pdfIn PDF document text
    • https://wiguduwinulag.weebly.com/uploads/1/4/1/5/141565797/4786757.pdfIn PDF document text
    • https://lepudumewo.weebly.com/uploads/1/3/5/9/135962044/d9edadeb22.pdfIn PDF document text
    • https://dozolujikofirig.weebly.com/uploads/1/3/1/8/131856703/1926812.pdfIn PDF document text
    • https://vorenamu.weebly.com/uploads/1/3/4/2/134265490/3696811.pdfIn PDF document text
    • http://spaconsulting.pl/userfiles/file/29540073469.pdfIn PDF document text
    • https://truyenskyt.com/upload/ckeditor/files/25251727289.pdfIn PDF document text
    • http://hoigolfbinhthuan.com/users/files/74152868021.pdfIn PDF document text
    • https://besavijoxamidu.weebly.com/uploads/1/3/4/0/134096513/2ed16.pdfIn PDF document text
    • http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621a94eb96f03---18945726955.pdfIn PDF document text
    • https://xavidupi.weebly.com/uploads/1/3/4/7/134723560/xenewaduge.pdfIn PDF document text
    • http://studioindelicato.com/userfiles/files/bovejinuwanako.pdfIn PDF document text
    • http://stigstudiotecnico.it/userfiles/files/forasagudutoj.pdfIn PDF document text
    • https://bolubevegu.weebly.com/uploads/1/3/1/4/131454373/gozisujuwisero-lajumazugelox-zulononoxogu.pdfIn PDF document text
    • http://librojuridico.com/aym_images/files/23472033219.pdfIn PDF document text
    • http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/16233f4162243b---salakuluxadusi.pdfIn PDF document text
    • https://fp-088.flexxmedien.com/flexxtrader/data/usf/file/jikibijafepamoletonuvuvak.pdfIn PDF document text
    +9 more URL(s)

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003e7fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E7FD 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0004000f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4000F 16420 bytes
SHA-256: 2dd8ad932a18aaa7f762005588c625c99fa79eb732d011452001e065a31be90f
font_02_sfnt_off00042a8b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42A8B 11196 bytes
SHA-256: e8155459ac25a294501df0d4cb664cb98ce20ed66b7081e811e7ce66c2a908b3

Open this report in the interactive analyzer, or submit your own file for analysis.