Malicious PDF — malware analysis report

Static analysis result for SHA-256 45099e5bc26b6400…

MALICIOUS

PDF

480.4 KB Created: 2022-04-15 11:17:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-25
MD5: f4c76ba0e5b67343d88764b86a6e03d3 SHA-1: e97384c8636e1e70365aa5eed8ff48c399c7d723 SHA-256: 45099e5bc26b640015dec0a25409f8e0635a3cc942049a757f863265006d28b2
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3656

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=fca+guidelines+on+outsourcing+arrangements PDF link annotation
    • https://jojipizi.weebly.com/uploads/1/3/1/6/131606457/1394748.pdfIn PDF document text
    • https://egyiksem.hu/uploads/file/26246464883.pdfIn PDF document text
    • http://www.barrettmotors.com.au/templates/admin/js/kcfinder/upload/files/gisiletawomi.pdfIn PDF document text
    • https://areicon.com/images/file/1989730251.pdfIn PDF document text
    • https://tufafoselebore.weebly.com/uploads/1/3/5/3/135389740/3e7d60fab5.pdfIn PDF document text
    • https://dotifusogibosu.weebly.com/uploads/1/3/4/4/134458831/lijene-maraze-buniburavit.pdfIn PDF document text
    • https://edftrans.serwiskonsularny.pl/images_user/file/34639647572.pdfIn PDF document text
    • https://giligigava.weebly.com/uploads/1/3/4/4/134494785/ruxiwuxedizedodigan.pdfIn PDF document text
    • https://naloguvobiwulup.weebly.com/uploads/1/3/1/1/131163976/9f35b8f98.pdfIn PDF document text
    • http://openendrep.com/userfiles/files/88345651896.pdfIn PDF document text
    • https://julegorapatafoj.weebly.com/uploads/1/3/4/0/134016802/rusedu_lojigelubojig_xevomatefimixa.pdfIn PDF document text
    • https://gudugobaxav.weebly.com/uploads/1/3/4/5/134500737/lerilanukidupi.pdfIn PDF document text
    • https://guvepilafofifiv.weebly.com/uploads/1/3/4/6/134682232/lixapotoxikitag.pdfIn PDF document text
    • http://serenetour.com/image/upload/File/ketabugamaxijanik.pdfIn PDF document text
    • http://bisenzia.it/userfiles/files/vuxeg.pdfIn PDF document text
    • https://womubunu.weebly.com/uploads/1/4/1/2/141281740/1749772.pdfIn PDF document text
    • http://viajaconsciente.com/imagenes/userfiles/file/55512761872.pdfIn PDF document text
    • https://tonilawug.weebly.com/uploads/1/3/4/6/134652309/7023921.pdfIn PDF document text
    • https://designmaster.in/scgtest/eec-new/codelibrary/ckeditor/ckfinder/userfiles/files/devewur.pdfIn PDF document text
    • http://8foro.exceltur.org/exceltur_nuevo/ckfinder/userfiles/files/wisugakaxifuvesazevefi.pdfIn PDF document text
    • http://multi-accueil.fr/ressource/site-image/files/zexibajavopupuxudubikize.pdfIn PDF document text
    • http://zatoodesign.com/userfiles/files/gifokonaxogexunujo.pdfIn PDF document text
    • https://expobar.vn/app/webroot/files/images/pages/files/bofijotawasisuk.pdfIn PDF document text
    • http://hyundainhapkhau.net/upload/files/setibunisidixanamoxive.pdfIn PDF document text
    • http://ahcxdq.com/uploads/file/171203585038.pdfIn PDF document text
    • https://rutebamem.weebly.com/uploads/1/3/4/8/134862863/xibudomega.pdfIn PDF document text
    • https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621166f41bfed---88662205828.pdfIn PDF document text
    • https://pexefosakojoma.weebly.com/uploads/1/3/1/4/131406105/xekupupobofam_punerigimomerej_widajud.pdfIn PDF document text
    • https://kuvukodu.weebly.com/uploads/1/3/1/4/131453249/delodipobow_waraviramalo_wusesepa_kowikexum.pdfIn PDF document text
    • https://loboweron.weebly.com/uploads/1/3/2/6/132681880/lijazeputujuxeperoja.pdfIn PDF document text
    • http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/1620a1bdbf2d37---82234592635.pdfIn PDF document text
    • https://movimientofamiliadejesus.com/images/uploaded/file/dogeresapisoj.pdfIn PDF document text
    • http://www.barbantie.com.br/admin/plugins/ckeditor/kcfinder/upload/files/sugagiluruxupefazexupu.pdfIn PDF document text
    • https://donudokenib.weebly.com/uploads/1/3/4/6/134695728/bofolafanorixij.pdfIn PDF document text
    • http://trailerdepot.ca/site-uploads/kopisakirijebomugile.pdfIn PDF document text
    • http://katela.net/userData/board/file/89846619970.pdfIn PDF document text
    • https://jukegiger.weebly.com/uploads/1/3/4/6/134668336/nesulewutidup-meraxiputunos-wasenofakofowa.pdfIn PDF document text
    • https://mygrind.ie/userfiles/file/52424314211.pdfIn PDF document text
    • https://bienenaktuell.com/sites/bienenaktuell.com/files/file/teluwitojifisoxe.pdfIn PDF document text
    • https://mulononar.weebly.com/uploads/1/3/5/9/135959518/8be4dbc.pdfIn PDF document text
    • https://vedakevuvapi.weebly.com/uploads/1/3/4/0/134013486/599dbb98.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00071299.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00071299.bin)

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00071299.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71299 17948 bytes
SHA-256: 4ba1d0d9754833ef4f61e351bfb305be330b11cb6b0351f9b204c80bd442c396
font_01_sfnt_off00074068.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x74068 10788 bytes
SHA-256: fdcd2c58a997e748b0f2f4569a7d5148b71bdd5894fc44a3c6fa0e1076dd823d
font_02_sfnt_off00075919.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75919 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.