Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b69eb117c3fc0b0…

MALICIOUS

PDF

351.5 KB Created: 2022-03-16 00:53:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-17
MD5: 097fb77bb2e41419ef5804dd36fcd5e7 SHA-1: dc03658f03de25bcf1a0bb38d992866ae70a6706 SHA-256: 2b69eb117c3fc0b002ee850e66de285055fbd3b9b1fbd9259af1e539fadfbeec
174 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5565

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lovig.co.za/XSRYdR1H?utm_term=target+flannel+sheets+california+king PDF link annotation
    • http://mot-a-mot.fr/kcfinder/upload/files/49459311490.pdfIn PDF document text
    • http://wallbedsindia.com/uploads/69745160386.pdfIn PDF document text
    • http://ns1.websitesky.net/app/webroot/upload/files/fisexuwalitopowugoze.pdfIn PDF document text
    • http://www.asbea.org.br/assets/plugins/kcfinder/upload/files/sigejonidusebivam.pdfIn PDF document text
    • http://pc75.net/upfiles/file/1644193098.pdfIn PDF document text
    • http://globalcenterhotels.com/bot/ckfinder/uf/files/xizifoduwo.pdfIn PDF document text
    • https://okazionche.com/files/nurum.pdfIn PDF document text
    • https://www.beltiar.by/css/assets/plugins/kcfinder/upload/files/vesulupewisevatavafix.pdfIn PDF document text
    • https://cvenhancer.com/wp-content/plugins/super-forms/uploads/php/files/b6eea6c1fcb0b6d89e4f124ec7b9db63/88811248032.pdfIn PDF document text
    • https://questymeca.questyme.com/userfiles/file/xalalakabatalafa.pdfIn PDF document text
    • http://alpanelektrik.com/depo/sayfaresim/file/bodarajizok.pdfIn PDF document text
    • https://santchavarabed.in/ckfinder/userfiles/files/ziradetafuserejolilovam.pdfIn PDF document text
    • https://ikomsolutions.com/admin/userfiles/file/fejilapamigotovalopezax.pdfIn PDF document text
    • http://orlickachata.cz/files/files/28149650374.pdfIn PDF document text
    • https://www.transportesoro.com.co/admin/plugins/ckeditor/kcfinder/upload/files/70736317321.pdfIn PDF document text
    • https://www.ssemusic.com/kcfinder/upload/files/93035203498.pdfIn PDF document text
    • https://venus-forever.com/image/files/73936506327.pdfIn PDF document text
    • http://qts.pandae.biz/views/images/sign/file/70243049190.pdfIn PDF document text
    • http://evohome.pl/userfiles/file/67797795392.pdfIn PDF document text
    • http://snap-drone.com/userfiles/file/54073320133.pdfIn PDF document text
    • https://condominiovillage.com/userfiles/file/49173128986.pdfIn PDF document text
    • http://www.festivalmarrakech.info/wp-content/plugins/formcraft/file-upload/server/content/files/1622cf346df1b8---27801132256.pdfIn PDF document text
    • http://sun-eko.eu/files/file/kotuluritita.pdfIn PDF document text
    • http://ranaghatpchsschool.org/userfiles/file/95608147454.pdfIn PDF document text
    • http://greenld.com/userfiles/65099314126.pdfIn PDF document text
    • http://www.granito-terrazzo.be/ckeditor/kcfinder/upload/files/nawigisuvug.pdfIn PDF document text
    • http://k-souz.com/userfiles/file/lalidavozivavurelivibiwo.pdfIn PDF document text
    • http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161fad978ec2d9---47185519231.pdfIn PDF document text
    • http://vitalbafitnessclub.eu/userfiles/files/95672179477.pdfIn PDF document text
    • https://jatransfer.com/userfiles/file/77953324280.pdfIn PDF document text
    • http://www.poliklinika-hb.cz/userfiles/file/kasuwekefepuxit.pdfIn PDF document text
    • http://nktrading.qa/file/files/47095483336.pdfIn PDF document text
    • http://bulk-supplies.com/userfiles/files/bomukinutujafagetomuw.pdfIn PDF document text
    • http://ikmblansko.cz/files/upload/files/zusikenepavojitivozenobaj.pdfIn PDF document text
    • https://armature.ir/cache/fck_files/file/motebogavelu.pdfIn PDF document text
    • http://sinners-party.de/media/file/wixopirakuwut.pdfIn PDF document text
    • http://etspak.com/survey/userfiles/files/livasami.pdfIn PDF document text
    • http://urbariatprasice.sk/upload/file/kepikul.pdfIn PDF document text
    • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/b5e8e80bf2fbfcf9b733d1c500bfd673/dapituka.pdfIn PDF document text
    • http://www.crislbd.com/public/admin/assets/ckeditor/kcfinder/upload/files/mamilulupuwetiwuk.pdfIn PDF document text
    • http://lilipoupoli-drama.gr/lilipoupoli/js/ckfinder/userfiles/files/7954875250.pdfIn PDF document text
    • http://www.plavanikojencupraha.cz/upload/files/64322291917.pdfIn PDF document text
    • http://www.dispatchls.com/backend/web/kcfinder/upload/files/lutodawo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    +2 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000507d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x507D6 10668 bytes
SHA-256: e889496f8dc229e51802d71384d1bb86b0f622675826f745a580fcd5e0f38ea5
font_01_sfnt_off00052040.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52040 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_02_sfnt_off0005375d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5375D 20012 bytes
SHA-256: 6cf2b510804a07e701ce77fd458281b568e66c95bb5d900adb4ea8fe9a3cb482

Open this report in the interactive analyzer, or submit your own file for analysis.