PDF malware analysis — malicious · 2b69904de7596ef4

MALICIOUS

PDF

94.2 KB Created: 2022-05-05 01:39:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-17

MD5: c6524724bc72c76f42749e9a9da00ab1 SHA-1: d14ec77ee6833fab174989b090a0ec9914d7ce10 SHA-256: 2b69904de7596ef4b51e5bf07b65f169b06165ca7526b53db2df20cf21453072

186 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9930

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fecuq.co.za/YmrXLWy8?keyword=life%20and%20death%20twilight%20reimagined%20pdf%20download%20pdf%20download%20full%20movie PDF link annotation
- http://newms.imprendia.it/userfiles/file/98463460147.pdfIn PDF document text
- http://aranykoronakft.hu/userfiles/file/45809699492.pdfIn PDF document text
- https://samibogamo.weebly.com/uploads/1/3/4/8/134883552/xameba.pdfIn PDF document text
- https://kagunalikabogow.weebly.com/uploads/1/3/5/3/135350350/babipugexaruxa.pdfIn PDF document text
- https://papozigej.weebly.com/uploads/1/3/1/8/131858530/foguzoxaj_nepom_vijipepogezak.pdfIn PDF document text
- https://guwakeba.weebly.com/uploads/1/3/4/5/134597639/2cb5ea89b5a945.pdfIn PDF document text
- https://dejutuzalusabi.weebly.com/uploads/1/3/4/8/134869317/c40ac6eb2.pdfIn PDF document text
- https://dududisekit.weebly.com/uploads/1/3/4/3/134348084/jonesomufurapetakij.pdfIn PDF document text
- https://rizekojak.weebly.com/uploads/1/4/1/4/141468140/5182187.pdfIn PDF document text
- https://xozemupugumofu.weebly.com/uploads/1/3/4/3/134320042/1875551.pdfIn PDF document text
- https://wmu24.ru/media/file/vogazabuvulo.pdfIn PDF document text
- https://ww150004.linebot.net/upfile/files/20220310025620.pdfIn PDF document text
- https://fomukudir.weebly.com/uploads/1/3/4/4/134403856/760f3581cf9.pdfIn PDF document text
- https://fibovasononeboj.weebly.com/uploads/1/3/4/7/134732795/e35f447582fba7.pdfIn PDF document text
- https://jenodaxadow.weebly.com/uploads/1/3/4/0/134012655/4d32e9bdb6.pdfIn PDF document text
- https://xulibaro.weebly.com/uploads/1/3/4/0/134041525/kusirivutoxab.pdfIn PDF document text
- https://jevebuna.weebly.com/uploads/1/3/4/5/134594548/vomumil.pdfIn PDF document text
- https://babivefe.weebly.com/uploads/1/3/5/3/135312435/b324be3b14.pdfIn PDF document text
- https://jewizebalize.weebly.com/uploads/1/3/4/6/134618682/9738c278dfc989.pdfIn PDF document text
- https://bugabomusajo.weebly.com/uploads/1/3/4/5/134509224/1251505.pdfIn PDF document text
- https://doluduzugemuj.weebly.com/uploads/1/3/1/4/131411539/mixeb.pdfIn PDF document text
- https://monokuzofo.weebly.com/uploads/1/3/2/7/132741222/8aec76f22a4caf.pdfIn PDF document text
- https://guzozexuvuro.weebly.com/uploads/1/3/4/3/134322735/zediribupuvikusarito.pdfIn PDF document text
- https://zepemotofilizag.weebly.com/uploads/1/3/5/3/135399015/9781002.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f493.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF493	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00010ca4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10CA4	16244 bytes
SHA-256: `e7dcccb9dfd9af6e03f3e27ca667375aa35713eca2ac54ad74d69b3a5e8ad894`
`font_02_sfnt_off000122a4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x122A4	17540 bytes
SHA-256: `9b61e7c54244ccc6c66dd76e84e5862153f111bc28c474a8fcb264a868cc17a5`
`font_03_sfnt_off000150a3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x150A3	10988 bytes
SHA-256: `97e75fd567e7066c5890981eb185f875f2b980802f2b149b2f6cf9784e349ca1`

Open this report in the interactive analyzer, or submit your own file for analysis.