Malicious PDF — malware analysis report

Static analysis result for SHA-256 459ab32295ec16b5…

MALICIOUS

PDF

547.6 KB Created: 2022-04-16 21:25:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-07-17
MD5: eb68e1ba82886f38e283876d3b78e882 SHA-1: 0553fb5efacbe10163aa3ddb6f0648198215945f SHA-256: 459ab32295ec16b5b1f362ac031ba086f69e06045989a7c494c79cc8b9abdb4d
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3400

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/XSRYdR1H?utm_term=farmers+almanac+2019+indiana+planting+guide PDF link annotation
    • https://mufiguxibetifo.weebly.com/uploads/1/3/1/6/131607440/5125911.pdfIn PDF document text
    • https://semsaesp.com/ckfinder/userfiles/files/89673821040.pdfIn PDF document text
    • http://www.kliningstroy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1621f1533e73f9---30958897427.pdfIn PDF document text
    • https://tusutaxuwipafu.weebly.com/uploads/1/3/4/4/134403355/tetatasikekij_kotibunefixedir.pdfIn PDF document text
    • http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/162586b8d54398---60132532097.pdfIn PDF document text
    • http://jjkxmy.com/upload/files/202202141957286522.pdfIn PDF document text
    • https://powofowus.weebly.com/uploads/1/3/4/5/134583567/jefaw.pdfIn PDF document text
    • https://kujulofemalil.weebly.com/uploads/1/4/1/3/141364464/733746.pdfIn PDF document text
    • https://www.smartfutureexpo.com/ckfinder/userfiles/files/wesoza.pdfIn PDF document text
    • https://franciscojaviermoreno.com/DocsCKeditor/files/mogolasajuviwatoza.pdfIn PDF document text
    • https://kakajuxo.weebly.com/uploads/1/4/1/2/141294978/rejunapubigi.pdfIn PDF document text
    • https://zetozegazironik.weebly.com/uploads/1/3/2/6/132696155/tedobibux_tusolovu_suzikawuxowu.pdfIn PDF document text
    • https://dorenezawux.weebly.com/uploads/1/3/5/3/135383086/gixododaga.pdfIn PDF document text
    • https://gixejeti.weebly.com/uploads/1/3/4/3/134326891/650ccc56.pdfIn PDF document text
    • https://dozofuwel.weebly.com/uploads/1/3/5/9/135960373/110c578c78c7.pdfIn PDF document text
    • http://jandebruijn.com/uploadimages/files/naxaduxazovojotev.pdfIn PDF document text
    • https://semsaesp.com/ckfinder/userfiles/files/fizulefuzolaburigij.pdfIn PDF document text
    • https://dewejudinasul.weebly.com/uploads/1/3/4/7/134702466/5c5be0b.pdfIn PDF document text
    • https://xawiwewediwo.weebly.com/uploads/1/3/4/0/134017039/gobovowodije.pdfIn PDF document text
    • https://jerumegilaguro.weebly.com/uploads/1/3/0/7/130776399/d1f79a716588f.pdfIn PDF document text
    • https://dodizavezoku.weebly.com/uploads/1/3/1/3/131398251/bituwo.pdfIn PDF document text
    • https://mutomutozuso.weebly.com/uploads/1/3/0/8/130814133/janenopuk-ratasowogalose.pdfIn PDF document text
    • https://bizutimuja.weebly.com/uploads/1/3/3/9/133999747/topigegozid.pdfIn PDF document text
    • http://tao-ssct.org/data/upload/file/81360094803.pdfIn PDF document text
    • http://ahtirka.topmebli.com/content/xuploadimages/file/zisugowofetevu.pdfIn PDF document text
    • http://villa-carlshorst.de/sites/default/files/file/33080950457.pdfIn PDF document text
    • https://dovebibo.weebly.com/uploads/1/4/1/4/141429075/nipitibupi-bitepoxusi-fuzezex.pdfIn PDF document text
    • https://letunaxure.weebly.com/uploads/1/3/1/3/131383761/8e70d1afdd3ee.pdfIn PDF document text
    • https://nomortiga.com/contents/files/digigivilepafugiwi.pdfIn PDF document text
    • http://saga.diamonds/uploads/ckfinder/files/regugiwabugabebesow.pdfIn PDF document text
    • https://doneganaruko.weebly.com/uploads/1/4/1/2/141280002/tipogalifo_mixenuduk.pdfIn PDF document text
    • https://xorurilij.weebly.com/uploads/1/3/5/3/135325910/netolabawus.pdfIn PDF document text
    • https://bajkolandia.halpress.eu/userfiles/file/ruwevozabituwosepulig.pdfIn PDF document text
    • https://fonagidosoribir.weebly.com/uploads/1/3/7/5/137515196/nudavidexawarofojow.pdfIn PDF document text
    • http://desimlockage-telephone.fr/userfiles/file/48870515685.pdfIn PDF document text
    • https://exam11.menapoint.com/app/webroot/upload/files/vumetegigisufex.pdfIn PDF document text
    • http://chapraptti.org/userfiles/file/93480940531.pdfIn PDF document text
    • https://juvinegedixipa.weebly.com/uploads/1/3/1/6/131637649/vawatawewaxujuwot.pdfIn PDF document text
    • https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620c6338d62e8---jozuxakagopixazev.pdfIn PDF document text
    • https://nanapazux.weebly.com/uploads/1/3/7/5/137513245/f673f9f737ebe2.pdfIn PDF document text
    • https://fojaruzagix.weebly.com/uploads/1/3/1/3/131379198/3565511.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00081746.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00081746.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00081746.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x81746 20028 bytes
SHA-256: 407d52d9fd3958844198736f3e972bf2e7694ddb6c336cd11b46a1eefd0e45dd
font_01_sfnt_off00084b73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84B73 11276 bytes
SHA-256: 3c503981e9f135b178f3832f73293af6130553d8df2b39ef24c2e7a6075a8e4a
font_02_sfnt_off000865c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x865C6 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.