Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a1c943c364a26ee…

MALICIOUS

PDF

408.5 KB Created: 2022-05-02 23:58:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-31
MD5: 0c75dcba6b83c9d5f573a3c421f90890 SHA-1: 0916c4d15c034fec92d1fbbaf053dcf337c31c0a SHA-256: 5a1c943c364a26eea4b4ef44f56d2e586c52cace7c67e784c5f9f8de3114ad86
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5061

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fecuq.co.za/XSRYdR1H?utm_term=dbz+androids+1-+20 PDF link annotation
    • https://kajibelewori.weebly.com/uploads/1/3/4/3/134307873/4646076.pdfIn PDF document text
    • http://clairerolo.com/userfiles/file/gexuresep.pdfIn PDF document text
    • https://centralleiloes.com.br/admincentral/ckeditor/kcfinder/upload/files/71025839472.pdfIn PDF document text
    • https://kizuzeno.weebly.com/uploads/1/3/5/3/135326612/26e901.pdfIn PDF document text
    • https://kuvixajixi.weebly.com/uploads/1/3/1/6/131637850/vinotafew-bapugakowofid.pdfIn PDF document text
    • https://betiriwusogaz.weebly.com/uploads/1/3/1/3/131380032/8587736.pdfIn PDF document text
    • https://clinicaalcantara.es/sites/default/files/userfiles/file/24151303934.pdfIn PDF document text
    • https://zawukidunizilo.weebly.com/uploads/1/4/1/3/141344262/0dec9afb9.pdfIn PDF document text
    • https://xn--80aaa1arbfjoe3bzh.xn--p1ai/data/files/bujerinolaso.pdfIn PDF document text
    • https://weratirotiset.weebly.com/uploads/1/3/4/3/134322017/kofexolodina.pdfIn PDF document text
    • http://conomiya.com/images/uploadedimages/file/78480079444.pdfIn PDF document text
    • https://xuzijobozu.weebly.com/uploads/1/3/1/4/131411245/6586737.pdfIn PDF document text
    • https://xowivana.weebly.com/uploads/1/3/0/8/130813667/1568513.pdfIn PDF document text
    • https://xumotisububilup.weebly.com/uploads/1/3/4/5/134591263/sapufavidinavok.pdfIn PDF document text
    • https://jabudebixeref.weebly.com/uploads/1/3/4/3/134398441/dc43062.pdfIn PDF document text
    • https://xasezufud.weebly.com/uploads/1/3/4/0/134016907/lafofexomirubisuwu.pdfIn PDF document text
    • http://fitnessklub-impuls.pl/uploads/assets/file/nogexijiwokewalozo.pdfIn PDF document text
    • https://insights3.com/wp-content/plugins/super-forms/uploads/php/files/e75f74a43671d63fe0bcaaaf67c90362/91192345884.pdfIn PDF document text
    • http://aptekarynek.pl/zdjecia/fck/file/64432356529.pdfIn PDF document text
    • http://konsultacjenaukowe.eu/Upload/file/zidurebafobuzotalusabosa.pdfIn PDF document text
    • https://zakulupibuwuvos.weebly.com/uploads/1/3/4/6/134686441/jefozosezamibako.pdfIn PDF document text
    • http://gpmpoolandspa.com/ckfinder/userfiles/files/694216023.pdfIn PDF document text
    • https://www.mercato.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1620cf42952673---dubesilofarat.pdfIn PDF document text
    • https://sukorason.weebly.com/uploads/1/3/4/5/134578332/9264690.pdfIn PDF document text
    • https://pawiwojofidinof.weebly.com/uploads/1/3/4/4/134458390/poxoj-fobemet-ximefixazufomuv-lonufudevagap.pdfIn PDF document text
    • http://liebherr-tr.com/userfiles/file/rujadujoropamezisopale.pdfIn PDF document text
    • https://losanewu.weebly.com/uploads/1/3/7/5/137516341/peselazara_waxefomegiwegu.pdfIn PDF document text
    • https://wuxorazaw.weebly.com/uploads/1/3/2/7/132712222/somaki-xikifi-netubor.pdfIn PDF document text
    • https://ztracenaexistence.cz/files/content/file/37139101723.pdfIn PDF document text
    • http://vp-concept.ch/app/webroot/kcfinder/upload/files/20408633434.pdfIn PDF document text
    • https://xiresipi.weebly.com/uploads/1/3/1/1/131164504/554ce27ea37fd2d.pdfIn PDF document text
    • https://sharedsynergy.com/userfiles/file/92195102837.pdfIn PDF document text
    • http://zzweien.com/d/files/pojapesezojoriwas.pdfIn PDF document text
    • http://gemeinschaftshaus-grossmuss.de/demo/admin/editor/kcfinder/upload/files/10666834955.pdfIn PDF document text
    • https://detawokigar.weebly.com/uploads/1/3/1/4/131453745/a2402209d7268a.pdfIn PDF document text
    • https://twinslock.com/ckfinder/userfiles/files/49312093040.pdfIn PDF document text
    • https://tedinuvade.weebly.com/uploads/1/3/4/3/134348171/9767941.pdfIn PDF document text
    • https://dolijirobodukij.weebly.com/uploads/1/3/5/4/135400652/2229904.pdfIn PDF document text
    • http://helpnri.org/kcfinder/upload/files/liwonil.pdfIn PDF document text
    • https://www.hdcorp.com.br/wp-content/plugins/super-forms/uploads/php/files/bq2cdtfpa53to98g97nmq83aqc/31086038297.pdfIn PDF document text
    • https://acrgruppe.de/userfiles/file/6030687794.pdfIn PDF document text
    • https://fadusibolene.weebly.com/uploads/1/3/4/0/134042843/7a73772760b62.pdfIn PDF document text
    • http://art-lan.ru/uploads/assets/file/tenota.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    +2 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005daf7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5DAF7 10496 bytes
SHA-256: ff96c09b17d0e9e48d6b95192abcaf798259fe3e2452d795e8635e96813b7ca3
font_01_sfnt_off0005f2fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F2FE 4112 bytes
SHA-256: c81a39df9f4183dc187ed39e5c527c6c065731f5ebde07078d8c7600ddbcb8ab
font_02_sfnt_off00060305.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60305 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00061b22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61B22 21132 bytes
SHA-256: 9f2b9350847cd843b4d6b9526c3806c53b9affa5a79ac1f6479b6bb23532d5e9

Open this report in the interactive analyzer, or submit your own file for analysis.