PDF malware analysis — malicious · 4453d059b1e8ae2a

MALICIOUS

PDF

69.5 KB Created: 2022-04-10 03:39:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-10

MD5: 319c4f598541facdfb8a453a901125c7 SHA-1: 9c2e8c4e577c5c971b64edb82f65a854dcc767d7 SHA-256: 4453d059b1e8ae2a6229acd622a690b4e4cabec7cccd935025a8502858978e48

126 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://norin.co.za/YmrXLWy8?keyword=tracfone%20moto%20e5%20case PDF link annotation
- https://nergizleryapi.com/image/files/25148840631.pdfIn PDF document text
- https://durenubukipovav.weebly.com/uploads/1/4/1/2/141280374/siraburapoj.pdfIn PDF document text
- http://csc-028.com/userfiles/file/20220221074916_g415nr.pdfIn PDF document text
- http://tarp.longi.tw/uploadfiles/1337592321.pdfIn PDF document text
- https://dobopekajami.weebly.com/uploads/1/3/4/3/134314215/72b0690f2a06fd.pdfIn PDF document text
- https://jumozavuna.weebly.com/uploads/1/3/4/5/134598597/tatalod.pdfIn PDF document text
- http://metall-press.ru/files/watejez.pdfIn PDF document text
- https://vigowumiluz.weebly.com/uploads/1/3/1/3/131398530/dijubexofipa.pdfIn PDF document text
- http://globalwan.jp/uploads/files/kemejefarigag.pdfIn PDF document text
- https://promoform.coreform.it/uploads/file/tuxujolovusubep.pdfIn PDF document text
- https://duvigefotazepex.weebly.com/uploads/1/3/0/7/130775674/1fdbc.pdfIn PDF document text
- https://tekstilkent.formenemlak.com/upload/ckfinder/files/25593736812.pdfIn PDF document text
- https://guijek.com/userfiles/file/wolegemo.pdfIn PDF document text
- https://aqua2go.pl/galeria/file/69757306085.pdfIn PDF document text
- https://makurabun.weebly.com/uploads/1/3/4/6/134651698/2859327.pdfIn PDF document text
- http://maysoi.com/hinhanh_fckeditor/file/81917238136.pdfIn PDF document text
- https://sarununow.weebly.com/uploads/1/3/4/3/134366188/599f8681553db3.pdfIn PDF document text
- https://kuvijukoma.weebly.com/uploads/1/4/1/2/141279137/dc5f993b3.pdfIn PDF document text
- https://aprilboya.com/userfiles/file/mozolew.pdfIn PDF document text
- https://premiersuli.hu/files/files/vupegudib.pdfIn PDF document text
- https://truonggiangcompany.com/userfiles/file/zaduwesunivewite.pdfIn PDF document text
- http://cocoabuterol.com/upload/files/60347814725.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000abff.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xABFF	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off0000c416.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xC416	10456 bytes
SHA-256: `c6f998a4699413510741c7696ad9711945a59bb58191e9bade42d0151766049a`
`font_02_sfnt_off0000dbe7.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDBE7	17012 bytes
SHA-256: `9918596eaa5eb04cc96a8aff686d9224dde44d5dc06c47933f0cfa4920368dac`

Open this report in the interactive analyzer, or submit your own file for analysis.