PDF malware analysis — malicious · 3dd040ce70a8523c

MALICIOUS

PDF

368.7 KB Created: 2022-01-17 12:27:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-26

MD5: 96e729292031b678d5a4788645b57f48 SHA-1: 6eb78f698e98f5d788a414f6884a69616238d816 SHA-256: 3dd040ce70a8523c412b3213bfa94934a38528f462d64f8ee5250d7d95ebbb27

144 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.7227

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://sabrinacoiffure.com/userfiles/file/3412673460.pdf In PDF document text
- https://songod.vn/uploads/image/files/8075170005.pdfIn PDF document text
- http://for-rent-antwerp.com/wp-content/plugins/formcraft/file-upload/server/content/files/161b4a30b8b7d8---ximarij.pdfIn PDF document text
- https://himalayanthailand.com/image/upload/File/buzugokugomuxu.pdfIn PDF document text
- http://wm-meyer.de/meyer/admin/editor/ckfinder/userfiles/files/gumuleledixusetunagunimaf.pdfIn PDF document text
- https://iieng.org/editor/ckfinder/userfiles/files/luriwevoguj.pdfIn PDF document text
- http://4998horo.gmmwireless.com/contents/files/zozeroxemuzib.pdfIn PDF document text
- https://www.grdr.org/paidel/ckfinder/userfiles/files/99450415466.pdfIn PDF document text
- https://portalkucharski.pl/app/webroot/media/files/44880247917.pdfIn PDF document text
- http://lev-steklo.ru/userfiles/file/sanajave.pdfIn PDF document text
- http://sintellect.ru/Repository/file/xabetebajipinoduma.pdfIn PDF document text
- https://sokolzgierz.pl/web/uploads/files/wuworovav.pdfIn PDF document text
- http://plusk-car.com/js/upload/files/lexojewomarutipiseguko.pdfIn PDF document text
- http://bitree.net/ckfinder/userfiles/files/60224662339.pdfIn PDF document text
- https://shinaltd.ru/images/file/63905411675.pdfIn PDF document text
- https://webseitenvergleich.com/newerac2c/userfiles/file/fagudekabukelatafawa.pdfIn PDF document text
- https://burragebrothers.com/demo/jolie/beta/userfiles/files/fuzamojanokoj.pdfIn PDF document text
- http://garagehayashi.com/js/upload/files/13933663664.pdfIn PDF document text
- https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1616ae0957ef7f.pdfIn PDF document text
- http://webyork.co.uk/kcfinder/upload/files/vuwimuvopixopufiwama.pdfIn PDF document text
- http://sushibelovo.ru/files/retofuxejoja.pdfIn PDF document text
- http://webbuilders.com/files/file/guduriwakakovu.pdfIn PDF document text
- http://zetrade.cz/userfiles/file/gamumim.pdfIn PDF document text
- http://feedproxy.google.com/~r/Xvkpad/~3/D9plVHj2VOU/uplcv?utm_term=electronically+stored+information+definedPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00054f27.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x54F27	20328 bytes
SHA-256: `8be296933cb2bdf4c488673dbd696c941b1e205fdbaed98d44690f6eb8c0ecf5`
`font_01_sfnt_off00058464.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x58464	16416 bytes
SHA-256: `cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336`
`font_02_sfnt_off00059b08.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x59B08	10732 bytes
SHA-256: `4bc1042032027a8b761dd49883885d766fe0b0bc1ee8d896c96c61dd952ae70f`

Open this report in the interactive analyzer, or submit your own file for analysis.