Malicious PDF — malware analysis report

Static analysis result for SHA-256 42569bad4b364929…

MALICIOUS

PDF

469.7 KB Created: 2022-02-14 22:49:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15
MD5: 310f73142938e565bc528489d32432eb SHA-1: fe8db668ce4c0d995522ea5aebb32b713ac04abf SHA-256: 42569bad4b364929476b7cebf583360d771257d95d532662ca9ff4b2ef667c45
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5494

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lazav.co.za/XSRYdR1H?utm_term=kaala+koothu+movie+songs PDF link annotation
    • http://northmarking.com/userfiles/files/47063335697.pdfIn PDF document text
    • https://hophamthaibinh.com/upload/files/7342793313.pdfIn PDF document text
    • http://globalfeedindustry.com/upload/files/labusulivorimipamij.pdfIn PDF document text
    • http://alfatreyd-mebel.ru/archive/images/file/67808552419.pdfIn PDF document text
    • http://mavelikaradiocese.org/rapha/ckfinder/userfiles/files/38784547801.pdfIn PDF document text
    • http://homeopathyhongkong.cn/files/47655551253.pdfIn PDF document text
    • http://gpkoaee.ru/ckfinder/userfiles/files/81203159711.pdfIn PDF document text
    • http://reliancefla.com/admin/images/file/zawiku.pdfIn PDF document text
    • http://rapet.hu/files/jipotunejin.pdfIn PDF document text
    • http://shangyi-pump.com/uploads/file/081453501377.pdfIn PDF document text
    • https://pmb.unimal.ac.id/assets/plugin/kcfinder/upload/files/39822902639.pdfIn PDF document text
    • http://njuhome.pl/ckfinder/userfiles/files/refafinixe.pdfIn PDF document text
    • http://ip-golubev.ru/ckfinder/userfiles/files/zewotasoj.pdfIn PDF document text
    • https://prosaison.fr/userfiles/files/91327178987.pdfIn PDF document text
    • https://hiperaktivite.info/userfiles/files/nalifofuwefagox.pdfIn PDF document text
    • http://orem.mn/uploads/files/kavemazabisane.pdfIn PDF document text
    • http://chickenwild.com/upload/contents/images/images/72744458382.pdfIn PDF document text
    • https://paloaltospeakerseries.com/wp-content/plugins/super-forms/uploads/php/files/5834814a8062d01068daeb9561f1466f/likawezipuxobewisofirug.pdfIn PDF document text
    • https://www.hasmow.com.au/application/third_party/ckfinder/userfiles/files/65667201803.pdfIn PDF document text
    • http://www.videobezopasnost.ru/ckfinder/userfiles/files/92685491323.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006cf6a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6CF6A 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_01_sfnt_off0006e684.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E684 16336 bytes
SHA-256: adf38969d40f501586e0caf93d33991e243baeeecfe575c4831cdbf64b7044fa
font_02_sfnt_off0006fc82.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6FC82 19176 bytes
SHA-256: 02e5cf3c5f3d7b9258b7537a4635a5baef885aae9361382be196f7138932c8b1
font_03_sfnt_off00072fbe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x72FBE 10704 bytes
SHA-256: 37fb69c53d376168f960edb7a246b9162faf60546d837e04acd9702fe676d78b

Open this report in the interactive analyzer, or submit your own file for analysis.