Malicious PDF — malware analysis report

Static analysis result for SHA-256 42559d02f65d5a4b…

MALICIOUS

PDF

282.8 KB Created: 2022-02-02 16:11:01 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15
MD5: 9c16d44f3936bdb67f3eda86f861dbbc SHA-1: 1989bcc6eab6d74f3749a7b53070a0cf6d26e47b SHA-256: 42559d02f65d5a4b4660c0f3642870c9f25c6477cd85a76e9f34bb2ccfa78acb
144 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5647

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://norin.co.za/XSRYdR1H?utm_term=saucony+everun+guide+10+womens PDF link annotation
    • http://kolaykanal.com/userfiles/files/vukenilotujinani.pdfIn PDF document text
    • http://bgindus.com/t/tutorfirm/uploads/ck/files/31012114926.pdfIn PDF document text
    • http://aaaa.handyfriendship.com/upload/files/xuzuwerebotakarexasu.pdfIn PDF document text
    • http://ih-consultant.com/ckfinder/userfiles/files/36307526597.pdfIn PDF document text
    • http://forglory.cz/ckfinder/userfiles/files/rinuwiwetix.pdfIn PDF document text
    • http://gelinyuanyi.com/upload_fck/file/2022-1-31/20220131153454604842.pdfIn PDF document text
    • https://shopexpert.com/app/webroot/files/userfiles/files/35731264235.pdfIn PDF document text
    • http://stonepigments.com/userfiles/file/32265311903.pdfIn PDF document text
    • http://isystemlab.com/admin/ckfinder/userfiles/files/18219528456.pdfIn PDF document text
    • https://mraos.com/web/userfiles/file/54765999920.pdfIn PDF document text
    • https://onlinendttraining.net/files/67825697863.pdfIn PDF document text
    • https://www.htlexpress.com/ckfinder/userfiles/files/jawilofunugefusuwukujele.pdfIn PDF document text
    • http://www.pethouse.es/ckfinder/userfiles/files/56455927195.pdfIn PDF document text
    • https://xn----8sbaavnccwq4am.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/b7e5aea2ceb2c5f2688db4717284cc8d/gixezamerorovu.pdfIn PDF document text
    • http://poslovniimenik.net/firme_data/files/feveguzatovenanevesajel.pdfIn PDF document text
    • http://interiorconsignments.com/media/file/24815211916.pdfIn PDF document text
    • http://mvpvo.ru/userfiles/file/nedudidodugelitasoriziga.pdfIn PDF document text
    • http://crescentcarpets.com/userfiles/file/piwegadixuvegoj.pdfIn PDF document text
    • http://izhar-energy.com/userfiles/file/30703076335.pdfIn PDF document text
    • https://titishop.co/upload/files/97866810722.pdfIn PDF document text
    • http://electronicascanaresas.com/kcfinder/upload/files/23693231157.pdfIn PDF document text
    • https://cmsmda.neotebet.de/uploads/all/ligijikefoxom.pdfIn PDF document text
    • https://balatonfurediallatorvos.hu/userfiles/file/sirugemagixifu.pdfIn PDF document text
    • https://xn--80aesyq.xn--p1ai/files/file/zilaxiwisazetekedawo.pdfIn PDF document text
    • http://conservationenergy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612da88a1d817---bofepekezuginirojij.pdfIn PDF document text
    • http://unipsyclinic.com/userfiles/file/20211026015649.pdfIn PDF document text
    • http://www2.grupoksl.com.br/js/ckfinder/userfiles/files/sumafa.pdfIn PDF document text
    • https://firsatpin.com/calisma2/files/uploads/16815160394.pdfIn PDF document text
    • http://kyanite.tv/userfiles/file/naroketuwikegoxariwenokod.pdfIn PDF document text
    • http://tid.vn/upload/files/99203585178.pdfIn PDF document text
    • http://splhardware.com/UploadFile/file/2021091417541273499.pdfIn PDF document text
    • https://dmddsgn.com/wp-content/plugins/super-forms/uploads/php/files/4c31ec0630f0f5de2c94b676e71f1458/82527126928.pdfIn PDF document text
    • http://hmsendo.pl/uploads/editor/file/24147558525.pdfIn PDF document text
    • https://www.abrasco.org.br/ckfinder/userfiles/files/geraxa.pdfIn PDF document text
    • https://music-group-store.com/upload/files/lumisekumusefeguwiranumam.pdfIn PDF document text
    • http://ptsound.com/plugins/ckfinder/userfiles/files/8256556117.pdfIn PDF document text
    • http://www.casopisfolklor.sk/assets/kcfinder/upload/files/71101027792.pdfIn PDF document text
    • http://www.vishalsahni.com/public/ckfinder/userfiles/files/robolafififit.pdfIn PDF document text
    • http://wieswioska.pl/userfiles/file/91226298154.pdfIn PDF document text
    • https://sokolzgierz.pl/web/uploads/files/wuzovogevewidowumoxu.pdfIn PDF document text
    • http://banhangcongnghe.com/upload/FCK/file/97376764077.pdfIn PDF document text
    • http://ristoranteyuri2.com/userfiles/file/vexoluseze.pdfIn PDF document text
    • https://empezo.xyz/js/ckfinder/userfiles/files/12956572005.pdfIn PDF document text
    • https://1877painters.com/FCKeditor/file/xoninibuz.pdfIn PDF document text
    • https://myhoorayhealth.com/wp-content/plugins/super-forms/uploads/php/files/9a09ab3de323f8f401fdda39f039121b/lozigesilegabureno.pdfIn PDF document text
    • http://huerural.com/uploads/image/files/wefufavitimezexozixa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    +5 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003fd56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FD56 11184 bytes
SHA-256: efc09cf940841eca44a7f786809f4d94f02f1682156adbbaf6da3ee7f3c73ce1
font_01_sfnt_off00041760.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41760 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_02_sfnt_off00042e80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42E80 16784 bytes
SHA-256: 62a4214c20493671df8e0410dcabec274d60c6bff12fc8f67be6e737f6733ad8

Open this report in the interactive analyzer, or submit your own file for analysis.