Malicious PDF — malware analysis report

Static analysis result for SHA-256 5502c12dcab3673e…

MALICIOUS

PDF

285.5 KB Created: 2022-04-08 20:23:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-04
MD5: 6ac95336e20ab0a3c95760c5196efa7e SHA-1: ec776d6888e8febfcf79bd68632003f12d556981 SHA-256: 5502c12dcab3673e93a21636be9be403ab28ad2d5d2628edde68f0826b975252
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6089

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stfurnimart.com/file_media/file_image/file/78277400984.pdf In PDF document text
    • https://kozezivu.weebly.com/uploads/1/3/4/4/134444222/5289596.pdfIn PDF document text
    • https://bupekotarox.weebly.com/uploads/1/3/0/7/130739944/pezobami-zakojepedenesat.pdfIn PDF document text
    • https://vojumemij.weebly.com/uploads/1/3/4/4/134473557/bejagawi-mikizikubewok-pubaxowimejotu.pdfIn PDF document text
    • https://pernambucoimortal.com/imagens/files/99642545334.pdfIn PDF document text
    • https://fontini-rozetki.su/kcfinder/upload/files/sosumobujuzugedodoxide.pdfIn PDF document text
    • http://pijntherapie.be/uploads/files/54687433972.pdfIn PDF document text
    • http://workontext.ru/media/file/43099325322.pdfIn PDF document text
    • https://susevire.weebly.com/uploads/1/3/4/8/134885610/ac51879.pdfIn PDF document text
    • http://angel-conference.org/upload_fck/file/2022-2-27/20220227015741663653.pdfIn PDF document text
    • https://posolefuriw.weebly.com/uploads/1/3/4/3/134374222/c8da6c7d.pdfIn PDF document text
    • http://learningkey.org/userfiles/19872108113.pdfIn PDF document text
    • https://tahubunting1.com/contents/files/2271481848.pdfIn PDF document text
    • http://studiotecnicodavico.eu/userfiles/files/71302693589.pdfIn PDF document text
    • http://taikenplan.jp/ckfinder/userfiles/files/vupetuzib.pdfIn PDF document text
    • http://firstcuwire.com/file_media/file_image/file/fakesidakepakelejewinas.pdfIn PDF document text
    • https://3eyamaichi.com/upload/ckfinder_temp/files/20220310000259.pdfIn PDF document text
    • https://kanalprofi.at/UserFiles/file/90944967642.pdfIn PDF document text
    • http://livestocksaltlicks.com/ckeditor/kcfinder/upload/files/sujemefapexudusilu.pdfIn PDF document text
    • https://tagosijotibaza.weebly.com/uploads/1/3/1/4/131407106/fenajipi.pdfIn PDF document text
    • https://kafazuvowimi.weebly.com/uploads/1/3/4/7/134705673/9484711.pdfIn PDF document text
    • http://leadingedgecorporate.com/user_images/file/55374498784.pdfIn PDF document text
    • http://remproekt-m.ru/admin/ckfinder/userfiles/files/86656251496.pdfIn PDF document text
    • https://judupivaruva.weebly.com/uploads/1/3/0/7/130775992/075f59f0e8c8.pdfIn PDF document text
    • https://appchecar.com/ckfinder/userfiles/files/36423873690.pdfIn PDF document text
    • https://kifitakuridugiv.weebly.com/uploads/1/3/4/7/134770331/bibidenim_vodotazo_kaxavexariruxog.pdfIn PDF document text
    • https://xibokesobapud.weebly.com/uploads/1/3/0/7/130776239/fezasebitelilopat.pdfIn PDF document text
    • http://dpsnowodworze.pl/userfiles/file/madejetunebakowimovesowi.pdfIn PDF document text
    • https://waxevinibiwe.weebly.com/uploads/1/3/0/9/130969944/gevev_gulexonatuwalod_tidirim.pdfIn PDF document text
    • https://derirupuv.weebly.com/uploads/1/3/7/5/137511511/ff602826ddfbe.pdfIn PDF document text
    • https://divopugizupuja.weebly.com/uploads/1/3/4/4/134487222/18a0b75f3da28.pdfIn PDF document text
    • https://jevijoju.weebly.com/uploads/1/3/5/9/135978445/depojiwojizexujoroba.pdfIn PDF document text
    • https://netiwililisal.weebly.com/uploads/1/3/5/3/135398280/6449126.pdfIn PDF document text
    • http://transcash.com/ci/userfiles/files/vegawebulesezazigigopuku.pdfIn PDF document text
    • https://rizowexerezo.weebly.com/uploads/1/3/4/2/134265486/mukewipupen.pdfIn PDF document text
    • https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/e2d8c70dd6336de26fa699be1bce3760/xoxekajege.pdfIn PDF document text
    • https://fepaxumezo.weebly.com/uploads/1/3/4/3/134320712/5024497.pdfIn PDF document text
    • https://tukajolikapuz.weebly.com/uploads/1/3/5/3/135346043/voxixezebokugom.pdfIn PDF document text
    • https://xarefiliji.weebly.com/uploads/1/3/4/7/134735925/3756951.pdfIn PDF document text
    • https://fonasidijefem.weebly.com/uploads/1/3/4/6/134636639/e7d162aea2a.pdfIn PDF document text
    • https://ruwotoxo.weebly.com/uploads/1/4/1/2/141231791/f6cad816.pdfIn PDF document text
    • https://www.colfacor.org.ar/administrador_web/kcfinder/upload/files/53548342099.pdfIn PDF document text
    • https://tuxixomapom.weebly.com/uploads/1/3/4/6/134631546/8259523.pdfIn PDF document text
    • https://www.nitm.ac.in/nitmeghalaya/ckfinder/userfiles/files/dugavejebunelavamariwosu.pdfIn PDF document text
    • http://ty-universe.com/image/files/20220206_120512.pdfIn PDF document text
    • https://votilolezin.weebly.com/uploads/1/3/4/3/134307270/4266819.pdfIn PDF document text
    • http://sabotage-rockgroup.ru/upload/files/durilupofus.pdfIn PDF document text
    • https://www.euroservicemilano.it/wp-content/plugins/formcraft/file-upload/server/content/files/1624d6262539be---46031796339.pdfIn PDF document text
    • https://loheb.co.za/XSRYdR1H?utm_term=undertale+soundtrack+downloadPDF link annotation
    • https://dalowosa.weebly.com/uploads/1/3/4/3/134383453/gofomutol.pdfIn PDF document text
    +8 more URL(s)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004034d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4034D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00041b5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41B5F 18984 bytes
SHA-256: add6431897151457e95b9d7750fe8b70ae1f4dd333c0adfbe0ecea06ea5a48b2
font_02_sfnt_off00044d26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44D26 10556 bytes
SHA-256: 9e80cca80755325714334496c4a8864cd46087f828faf436b552fc180819d27c

Open this report in the interactive analyzer, or submit your own file for analysis.