PDF malware analysis — malicious · 4af2d8c012372eb6

MALICIOUS

PDF

88.5 KB Created: 2022-04-23 19:54:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-06

MD5: 5606841ca77d9b0040f218b27b3c37ce SHA-1: ad8e3dfcf9c43ecaac857734bc4b8b47bcb6ce6e SHA-256: 4af2d8c012372eb6fdb529e3ac517bdda807e71541681c78c8fdb3fcf956d0df

186 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9986

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mifuj.co.za/YmrXLWy8?keyword=hp%20photosmart%205520%20black%20ink%20not%20working PDF link annotation
- https://papuxivosep.weebly.com/uploads/1/3/4/4/134491017/xotavotetamibaz-mupoz.pdfIn PDF document text
- https://gadepututam.weebly.com/uploads/1/3/5/3/135325389/kosonusiwugeda_vidav.pdfIn PDF document text
- https://koforimexaxopax.weebly.com/uploads/1/3/4/8/134862174/95bd16048722b.pdfIn PDF document text
- https://pixtoonstudio.com/img/files/dotabavarilopuvowojid.pdfIn PDF document text
- https://guvepilafofifiv.weebly.com/uploads/1/3/4/6/134682232/megimotosuba-lazaxabizedoz-zukutomax.pdfIn PDF document text
- https://sca-eagleegg5k.com/ckfinder/triplebuserfiles/file/ziwiwojekolul.pdfIn PDF document text
- https://xalorato.weebly.com/uploads/1/3/4/3/134317389/wujudolazin.pdfIn PDF document text
- http://forumts.com/ckfinder/userfiles/files/tezasozomebaju.pdfIn PDF document text
- https://dalujukonuxuda.weebly.com/uploads/1/3/1/1/131163933/9b8be4a.pdfIn PDF document text
- https://xulixisasogo.weebly.com/uploads/1/3/4/3/134332745/zigamenel_movitaxu_jifeluxadivu_gosinigu.pdfIn PDF document text
- https://zagarete.weebly.com/uploads/1/3/4/6/134687236/vubikuz-mubasuwa-witesopisesodi-genutanute.pdfIn PDF document text
- https://tuzafezinaxav.weebly.com/uploads/1/3/4/3/134319976/6191dec0ffb.pdfIn PDF document text
- https://tukixetijire.weebly.com/uploads/1/3/4/3/134314539/mugomebogisa.pdfIn PDF document text
- https://goxutulolikum.weebly.com/uploads/1/3/0/8/130814421/982980.pdfIn PDF document text
- https://korutifo.weebly.com/uploads/1/4/1/2/141218337/1168209.pdfIn PDF document text
- https://sinofokum.weebly.com/uploads/1/3/5/3/135316266/2690691.pdfIn PDF document text
- https://lalibirubifo.weebly.com/uploads/1/3/0/8/130873838/0f1040025b0.pdfIn PDF document text
- https://fulugive.weebly.com/uploads/1/3/0/8/130874350/vafukezavamu.pdfIn PDF document text
- http://insk.ru/img/userfiles/file/vazenakurovisudupajabuwiz.pdfIn PDF document text
- https://loseseseveru.weebly.com/uploads/1/3/0/8/130813975/1806617.pdfIn PDF document text
- https://xezojasupaxu.weebly.com/uploads/1/3/4/3/134352535/nolegemoriluseb-mujuwex-fanekezobamowa-zejomobajupafiv.pdfIn PDF document text
- https://gukapubukon.weebly.com/uploads/1/3/4/1/134108909/togolulo.pdfIn PDF document text
- https://gefilatokakanor.weebly.com/uploads/1/3/7/5/137501249/majagoweladeji_togon_lowujikotexisur_fakituradaral.pdfIn PDF document text
- https://bativazuwa.weebly.com/uploads/1/3/0/9/130969541/5490628.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f178.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF178	11376 bytes
SHA-256: `80c19d249debdaf9db350cc80dc3b38fba08238d1b5c6769c6630a75ac128abd`
`font_01_sfnt_off00010bfa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10BFA	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0001240c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1240C	17812 bytes
SHA-256: `65b5d75ff0a442d00a04bc37309b765b5f4eeb3edc20feda562922ec016450a8`

Open this report in the interactive analyzer, or submit your own file for analysis.