Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c897c86155bca53…

MALICIOUS

PDF

253.8 KB Created: 2022-03-03 07:46:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-04
MD5: 2a8808a2b46042d4e5683f0f9aca2f5d SHA-1: 52bd6a674aff9684fb03d6a416e5d5b2310fae21 SHA-256: 2c897c86155bca5379cc6c110f9a561068239b93e7c2c3d38229d6ce5d2f0359
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7279

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://podar.co.za/XSRYdR1H?utm_term=application+catalogue+template PDF link annotation
    • http://nigerseedindia.com/uploads/83191579166.pdfIn PDF document text
    • https://a-metal.e-giant.net/archive/file/files/71054685051.pdfIn PDF document text
    • http://gesht.ru/admin/ckfinder/userfiles/files/94142014747.pdfIn PDF document text
    • http://beerskiboot.de/img/upload/file/62154498165.pdfIn PDF document text
    • http://ergo-logo-bamberg.de/userfiles/file/26238110942.pdfIn PDF document text
    • http://speckrepeg.by/UserFiles/files/jusel.pdfIn PDF document text
    • http://dekogard.net/deko/veri/_files/57992030043.pdfIn PDF document text
    • http://dgkno.cn/upload/tabekog.pdfIn PDF document text
    • http://saopauloairporttransfers.com/ckfinder/userfiles/files/zazugojevutidunat.pdfIn PDF document text
    • https://cafesca.info/ckfinder/userfiles/files/rosipubasulogeze.pdfIn PDF document text
    • https://davidfoleyinc.com/userfiles/file/47876180377.pdfIn PDF document text
    • http://proxima-design.cz/files/file/54990948738.pdfIn PDF document text
    • http://part-service55.ru/kcfinder/upload/files/56086545397.pdfIn PDF document text
    • http://www.megasaludips.com/wp-content/plugins/formcraft/file-upload/server/content/files/16217eb46c5b8b---lumir.pdfIn PDF document text
    • http://dongzzang.com/userfiles/file///ladimirifajen.pdfIn PDF document text
    • https://supermagnum-bg.com/ckfinder/userfiles/files/35407942135.pdfIn PDF document text
    • https://freshchannels.com/home/sites/freshchannels/public_html/ckfinder/userfiles/files/seratuvapinuxuwesunagamu.pdfIn PDF document text
    • http://modulobase.com/userfiles/file/35696230506.pdfIn PDF document text
    • http://ing-triplee.com/ckeditor/kcfinder/upload/files/34694056539.pdfIn PDF document text
    • https://euronuts2009.ge/files/files/46024438394.pdfIn PDF document text
    • http://iabmbikaner.org/public/ckeditor/kcfinder/upload/files/86807053750.pdfIn PDF document text
    • http://24hnbc.com/assets/ckfinder/core/connector/php/uploads/files/6889771274.pdfIn PDF document text
    • https://stollerco.com/testingsites/advantage_aviation/assets/media/file/64069051523.pdfIn PDF document text
    • http://kingkady.com/uploadfile/files/39681718833.pdfIn PDF document text
    • http://bukitjaya88.com/kcfinder/upload/files/25133351814.pdfIn PDF document text
    • https://sproname.com/files/userfiles/files/5426254729.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00038373.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38373 19920 bytes
SHA-256: b8b332bd8c1e0bc6a8d5ebd35501120e15104a31634c8a6e71a07199979659f1
font_01_sfnt_off0003b72b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B72B 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_02_sfnt_off0003ce4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3CE4B 10528 bytes
SHA-256: 46883b4a71e17a81f1ec8585554dccc5355e6e6e66c1509382952c78e056c597

Open this report in the interactive analyzer, or submit your own file for analysis.