Malicious PDF — malware analysis report

Static analysis result for SHA-256 29ce89eb48541479…

MALICIOUS

PDF

334.9 KB Created: 2022-06-08 08:12:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-18
MD5: c334962f880684e35049e8f32dc85bf6 SHA-1: 7598ed1c49b0fe55661f268a3e1749e1d78943b9 SHA-256: 29ce89eb485414796603af0d5fe9286492460435de10ba88e542b7efbcbf7576
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4214

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://norin.co.za/XSRYdR1H?utm_term=ultherapy+machine+manual+free+online+pdf+file PDF link annotation
    • https://zurapiwovop.weebly.com/uploads/1/4/1/2/141286355/fusikudiwu_xavesi.pdfIn PDF document text
    • https://fotekexilinita.weebly.com/uploads/1/3/4/2/134235887/3432924.pdfIn PDF document text
    • https://vozunekoba.weebly.com/uploads/1/3/4/9/134902797/sotanule-tipafirovozos-ganafufuf-duwovedab.pdfIn PDF document text
    • https://www.crosstownnews.in/kcfinder/upload/files/zekaz.pdfIn PDF document text
    • https://tavebazuliwib.weebly.com/uploads/1/4/1/6/141683240/busatafuzut.pdfIn PDF document text
    • https://nolodubul.weebly.com/uploads/1/4/1/2/141292574/vowegazopuvokawana.pdfIn PDF document text
    • https://wuvukimepegoj.weebly.com/uploads/1/3/4/6/134694914/beveto.pdfIn PDF document text
    • https://mobutezojo.weebly.com/uploads/1/4/1/4/141446165/3124268.pdfIn PDF document text
    • https://sinukofulav.weebly.com/uploads/1/3/4/6/134634738/8663041.pdfIn PDF document text
    • http://monthclean.com/uploads/files/202204220846413567.pdfIn PDF document text
    • https://xixafaxuxux.weebly.com/uploads/1/3/4/3/134340403/8463069.pdfIn PDF document text
    • https://tibesegekor.weebly.com/uploads/1/3/4/4/134495245/8183522.pdfIn PDF document text
    • https://ridazofevuxopi.weebly.com/uploads/1/4/2/0/142028061/nexakuviwadamu.pdfIn PDF document text
    • https://lasovudevafiwiw.weebly.com/uploads/1/3/4/3/134383328/volepexenob.pdfIn PDF document text
    • https://tozilamuvopodes.weebly.com/uploads/1/3/5/9/135966944/86ab49db.pdfIn PDF document text
    • https://kafowudozajem.weebly.com/uploads/1/3/4/6/134613952/zokiguzenum_pekeketaxajuloz_napavoresa_larutudepa.pdfIn PDF document text
    • https://tidekomix.weebly.com/uploads/1/3/4/4/134441433/jurav-kotabotaxesat-jazoveru-kevigamufuxe.pdfIn PDF document text
    • https://latavulepa.weebly.com/uploads/1/3/4/4/134461708/refizaze.pdfIn PDF document text
    • https://zasazijubafal.weebly.com/uploads/1/3/5/2/135299125/pazutakax.pdfIn PDF document text
    • https://subarijarasojud.weebly.com/uploads/1/3/4/3/134332778/vapekofajekitu.pdfIn PDF document text
    • https://loribipusav.weebly.com/uploads/1/3/1/3/131379532/9478588.pdfIn PDF document text
    • https://roruzutal.weebly.com/uploads/1/3/4/5/134592711/lujokijiviwezi_xugepitilami.pdfIn PDF document text
    • https://zisefedid.weebly.com/uploads/1/3/4/7/134767142/d5b7aea.pdfIn PDF document text
    • http://ngocphuocjsc.com/public/default/ckeditor/files/33731637040.pdfIn PDF document text
    • https://kinefowez.weebly.com/uploads/1/3/5/3/135329655/beb990fc989fd3.pdfIn PDF document text
    • https://japefixasi.weebly.com/uploads/1/4/2/0/142040600/9063950.pdfIn PDF document text
    • https://widolabi.weebly.com/uploads/1/4/1/2/141260391/f9fdeb5485cfb.pdfIn PDF document text
    • https://xlspandoek.nl/userfiles/file/54939875931.pdfIn PDF document text
    • https://fofawuparojimi.weebly.com/uploads/1/3/1/0/131070926/vifenozuzawu.pdfIn PDF document text
    • https://tuzitumup.weebly.com/uploads/1/3/4/3/134385826/vekabununekeg-nurovepinabekem-kojaxeduve-xupewip.pdfIn PDF document text
    • https://easypayindia.in/userfiles/file/13884419304.pdfIn PDF document text
    • https://tobakegerikudo.weebly.com/uploads/1/3/1/4/131482881/6638462.pdfIn PDF document text
    • https://josabinisepev.weebly.com/uploads/1/3/1/4/131452942/d550c299.pdfIn PDF document text
    • https://sowerijowirikuj.weebly.com/uploads/1/3/1/4/131437515/jabibat.pdfIn PDF document text
    • https://guzejanum.weebly.com/uploads/1/3/4/6/134681017/bawowis-xexajusirexu-kugetixofamok.pdfIn PDF document text
    • https://tafebitekule.weebly.com/uploads/1/3/0/7/130776603/3792943.pdfIn PDF document text
    • https://montferri.com/admin/js/plugins/kcfinder/upload/files/31821322480.pdfIn PDF document text
    • https://fububekamuko.weebly.com/uploads/1/3/3/9/133986391/7059445.pdfIn PDF document text
    • https://kasozufadoji.weebly.com/uploads/1/3/4/5/134523760/6669870.pdfIn PDF document text
    • https://fowitukusizuge.weebly.com/uploads/1/3/5/3/135325135/1327627.pdfIn PDF document text
    • https://midepixa.weebly.com/uploads/1/3/4/6/134622545/sakite_kalevepijewe_nopafi.pdfIn PDF document text
    • https://pufabakorulur.weebly.com/uploads/1/3/4/3/134320636/5821508.pdfIn PDF document text
    • https://kobetuditi.weebly.com/uploads/1/3/4/4/134446504/bagixesolo.pdfIn PDF document text
    • https://pegujugadul.weebly.com/uploads/1/3/1/6/131637136/lexom.pdfIn PDF document text
    • https://kigovedinefetup.weebly.com/uploads/1/3/1/3/131384362/vifevu.pdfIn PDF document text
    • https://zomurigokolu.weebly.com/uploads/1/3/1/4/131437535/225b4d5.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    +5 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004a7a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4A7A2 10936 bytes
SHA-256: b6d93a87719fce38c44f503f1df964c2afc72884f7dfbdf7cff751a1f527ea78
font_01_sfnt_off0004c0d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C0D6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0004d8f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D8F4 22692 bytes
SHA-256: ecd46a9e0bf4e58b20dd7b277a356e4dc866c1b6550d12a8f3e7b54baa7807bc
font_03_sfnt_off0005127c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5127C 16172 bytes
SHA-256: 8214b55e030c3cb37d727e4c02e4f9fe3cb7b8fc3885df20e34cb8ea79a6e3ab

Open this report in the interactive analyzer, or submit your own file for analysis.