Malicious PDF — malware analysis report

Static analysis result for SHA-256 413a67a0423842ba…

MALICIOUS

PDF

360.3 KB Created: 2022-04-17 20:25:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-10
MD5: cef589ecb2e85e2605e9ff02801ee98a SHA-1: 31a033251e4c6b606ce82a029cf45cfd996955d6 SHA-256: 413a67a0423842bafdf424af9853db4683841fc0b05f20b088993dde768052c0
104 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6817

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
    PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://norin.co.za/XSRYdR1H?utm_term=agneepath+songs++free+bollywood+songs PDF link annotation
    • https://daxolefuziru.weebly.com/uploads/1/3/5/9/135963055/3023450e931ff.pdfIn PDF document text
    • https://xuvogimomote.weebly.com/uploads/1/3/7/5/137515459/3737452.pdfIn PDF document text
    • https://vekazapez.weebly.com/uploads/1/3/4/6/134601327/df9c3d23d446.pdfIn PDF document text
    • https://zabivavisona.weebly.com/uploads/1/3/1/4/131452967/tazewiwaxifiboj_nufex_jopoxozapiwado_riwajif.pdfIn PDF document text
    • https://sinaxerepedosuj.weebly.com/uploads/1/3/1/3/131398545/mikelaxedizabopopux.pdfIn PDF document text
    • https://roxejane.weebly.com/uploads/1/3/4/4/134486752/wimudisugoxiv.pdfIn PDF document text
    • https://nigapabibaba.weebly.com/uploads/1/3/4/9/134903053/9132747.pdfIn PDF document text
    • https://baduripafab.weebly.com/uploads/1/3/4/6/134623558/2c7d97a96.pdfIn PDF document text
    • https://kamutimasevukov.weebly.com/uploads/1/3/1/8/131856564/mozuzuwobovasejogofa.pdfIn PDF document text
    • https://pepizowa.weebly.com/uploads/1/3/2/7/132711999/pefexafobepujo_wokexawa_novow.pdfIn PDF document text
    • https://jewajufigojoxi.weebly.com/uploads/1/3/1/4/131438211/0ed2eab04.pdfIn PDF document text
    • https://saratologikefir.weebly.com/uploads/1/3/4/6/134694013/146481.pdfIn PDF document text
    • https://lonitununosi.weebly.com/uploads/1/3/4/3/134322354/wakome.pdfIn PDF document text
    • https://zitasiga.weebly.com/uploads/1/3/6/0/136088478/gogopa.pdfIn PDF document text
    • https://tesejusijup.weebly.com/uploads/1/3/4/7/134704228/foruzumubolavikadidi.pdfIn PDF document text
    • https://xebeluxowupud.weebly.com/uploads/1/3/1/3/131384709/sekemerepilaz.pdfIn PDF document text
    • https://jekowidemovo.weebly.com/uploads/1/3/4/7/134702183/2188992.pdfIn PDF document text
    • https://zipijovef.weebly.com/uploads/1/3/4/6/134623752/xojeruxotifavofiz.pdfIn PDF document text
    • https://dovesexafonom.weebly.com/uploads/1/3/4/7/134702519/5949773.pdfIn PDF document text
    • https://lomagifotoji.weebly.com/uploads/1/3/0/8/130814873/8a4e3438fbc6694.pdfIn PDF document text
    • https://zalinojawovuga.weebly.com/uploads/1/3/4/8/134886974/48cbfbb585b.pdfIn PDF document text
    • https://zizuvikugit.weebly.com/uploads/1/3/1/3/131384696/karewimob.pdfIn PDF document text
    • https://bujubilefo.weebly.com/uploads/1/3/1/4/131406518/c4625.pdfIn PDF document text
    • https://rumarefux.weebly.com/uploads/1/3/1/0/131070750/5e659021ba.pdfIn PDF document text
    • https://tazabavirivagi.weebly.com/uploads/1/3/0/8/130814173/1239641.pdfIn PDF document text
    • https://ginuwawabesinu.weebly.com/uploads/1/3/1/1/131164414/8a8f548.pdfIn PDF document text
    • https://zodixezujiz.weebly.com/uploads/1/3/5/3/135345824/4553007.pdfIn PDF document text
    • https://lesaletalakiwop.weebly.com/uploads/1/3/1/3/131379456/molasa-gasemezabusedi.pdfIn PDF document text
    • https://vipomumukewa.weebly.com/uploads/1/3/0/8/130813786/8801831.pdfIn PDF document text
    • https://bukowimulo.weebly.com/uploads/1/3/1/4/131407836/9077591.pdfIn PDF document text
    • https://kijaxupujik.weebly.com/uploads/1/3/2/6/132695195/wobuvemipejezulosu.pdfIn PDF document text
    • https://jetizapu.weebly.com/uploads/1/3/4/3/134371104/mixufulepuwuw.pdfIn PDF document text
    • https://dezirivudamowi.weebly.com/uploads/1/3/1/8/131856369/a24157e4.pdfIn PDF document text
    • https://bagobizofenagex.weebly.com/uploads/1/3/4/7/134767931/tasopotejaromo-gotenubavez-jozigaxig.pdfIn PDF document text
    • https://lamuxoguva.weebly.com/uploads/1/3/4/8/134882056/95aabea11e4.pdfIn PDF document text
    • https://zulazuxalumino.weebly.com/uploads/1/3/1/6/131606396/279bf27.pdfIn PDF document text
    • https://sakidadofedoza.weebly.com/uploads/1/3/4/7/134762178/0d3ed5f2d7.pdfIn PDF document text
    • https://vexofemefenulo.weebly.com/uploads/1/3/4/5/134594555/devab.pdfIn PDF document text
    • https://jajonugofetafis.weebly.com/uploads/1/3/0/7/130776034/2306278.pdfIn PDF document text
    • https://sanavebopum.weebly.com/uploads/1/4/1/3/141327771/kepojaka.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005313c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5313C 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00054953.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54953 11004 bytes
SHA-256: 61ede1f3ea1497dacb52dd28cbae7c11b31a2f5e72ebe80d5359bd69865649eb
font_02_sfnt_off0005628a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5628A 18012 bytes
SHA-256: 71fc27cad101a4531c8dfbf6163d9c537ed57f52b181d3006f519fdbabb8a4c4

Open this report in the interactive analyzer, or submit your own file for analysis.