Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b6e0974caa931c1…

MALICIOUS

PDF

259.4 KB Created: 2022-05-10 13:56:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-17
MD5: 0551b816ccfa01706fc3965dbe1b3ee2 SHA-1: 426ec4115b1d30720701e94597d3e68ea4e03008 SHA-256: 2b6e0974caa931c16e0a8d5bcd3888e679da73f6b0d7a90cd07eb37812ceb897
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6013

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/XSRYdR1H?utm_term=bouncing+check+law+philippines+pdf+online+download+full+episode PDF link annotation
    • https://moraxegili.weebly.com/uploads/1/4/1/5/141586329/jimanatupubut_sexuruke_sodobikunokaf_botiwokeg.pdfIn PDF document text
    • https://hitourkorea.com/FileData/ckfinder/files/20220305_F21EBC3CE7C58002.pdfIn PDF document text
    • https://luxelekite.weebly.com/uploads/1/3/4/6/134656707/8087153.pdfIn PDF document text
    • https://molowusutet.weebly.com/uploads/1/3/1/3/131380828/judosi-pareraporidanu-bizowo.pdfIn PDF document text
    • https://tidijesugeji.weebly.com/uploads/1/3/4/7/134764535/1374607.pdfIn PDF document text
    • https://tovorugezix.weebly.com/uploads/1/3/4/5/134599805/vekan-fotutovewava.pdfIn PDF document text
    • https://ravemazezaj.weebly.com/uploads/1/3/4/8/134885195/ramumarug_pesolelemafe.pdfIn PDF document text
    • https://fezowekufeda.weebly.com/uploads/1/3/3/9/133999429/2136141.pdfIn PDF document text
    • https://all-stage-meditation.tw/uploads/files/61fa7384575c7.pdfIn PDF document text
    • http://peetersinstallatietechniek.nl/upload/files/22658427536.pdfIn PDF document text
    • http://filipdegreef.be/uploads/files/43987104779.pdfIn PDF document text
    • https://jibudodenip.weebly.com/uploads/1/3/4/3/134364722/vawekor.pdfIn PDF document text
    • http://www.holderit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1625691192b6bd---xigorudumezelonelur.pdfIn PDF document text
    • https://jifedusibifep.weebly.com/uploads/1/3/0/8/130813848/gazefaromuwogigur.pdfIn PDF document text
    • https://xurarasetar.weebly.com/uploads/1/3/4/0/134096945/didorisibin-mofusitetud.pdfIn PDF document text
    • https://zotujoku.weebly.com/uploads/1/3/5/3/135304148/pazoduwosaxesid.pdfIn PDF document text
    • https://suragovitig.weebly.com/uploads/1/3/4/2/134265770/7614058.pdfIn PDF document text
    • http://salonlomi.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1626bb69518de3---2349400113.pdfIn PDF document text
    • https://kapexuzavum.weebly.com/uploads/1/3/4/6/134691047/telun.pdfIn PDF document text
    • http://www.assistvaleur.co.jp/inc/kcfinder/upload/files/32368817576.pdfIn PDF document text
    • https://fezugewibopav.weebly.com/uploads/1/3/5/3/135346468/tisekalisepurow.pdfIn PDF document text
    • https://kutebebi.weebly.com/uploads/1/3/4/5/134528954/nebiramokoboror-pelojujit-gekebinoduranu.pdfIn PDF document text
    • http://mesterteto.hu/userfiles/file/ladekapufuremoku.pdfIn PDF document text
    • https://nibejenowazi.weebly.com/uploads/1/3/5/3/135347217/jabivi.pdfIn PDF document text
    • https://detifurotuso.weebly.com/uploads/1/3/5/3/135321595/8652231.pdfIn PDF document text
    • https://derutobaxiwo.weebly.com/uploads/1/4/1/4/141420564/fc4b6.pdfIn PDF document text
    • http://lyshiying.com/d/files/nixoviguzujupasonozoruka.pdfIn PDF document text
    • https://gesaseli.weebly.com/uploads/1/3/1/3/131379828/6110721.pdfIn PDF document text
    • https://sesadawaroni.weebly.com/uploads/1/3/5/2/135295108/zuruxotepemo.pdfIn PDF document text
    • http://robbymakka.com/userfiles/file/59426235813.pdfIn PDF document text
    • https://bibasalerudo.weebly.com/uploads/1/3/1/8/131857029/libazubalifovo.pdfIn PDF document text
    • https://kivopovolufom.weebly.com/uploads/1/3/3/9/133997215/3721537.pdfIn PDF document text
    • https://konevolog.weebly.com/uploads/1/3/1/6/131606720/6563692.pdfIn PDF document text
    • https://gamogonireme.weebly.com/uploads/1/3/4/3/134373284/2dbc4c450ab272f.pdfIn PDF document text
    • https://bixizevabusiku.weebly.com/uploads/1/3/4/4/134403351/fowuripepa-mubifit.pdfIn PDF document text
    • http://strap.sk/uploads/files/momoborebub.pdfIn PDF document text
    • https://xamirudanigux.weebly.com/uploads/1/3/0/9/130969419/1172530.pdfIn PDF document text
    • http://www.juniorcollege.cl/ckfinder/userfiles/files/26101091778.pdfIn PDF document text
    • https://sutulozutujak.weebly.com/uploads/1/3/4/8/134884412/7595228.pdfIn PDF document text
    • https://welogodeketi.weebly.com/uploads/1/3/5/3/135326703/e6fe7155.pdfIn PDF document text
    • http://sicompk.com/survey/userfiles/files/wovosovi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003a04a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A04A 16584 bytes
SHA-256: f3d17a613599678c904d9211fbdac37670eaf64041aebd8f3a49686d1957f042
font_01_sfnt_off0003cb08.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CB08 11032 bytes
SHA-256: 5cd545ea1896fbcac60e0c950cc45810936c0d6993cc4f646a383522b400983f
font_02_sfnt_off0003e48c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E48C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.