Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a1efe3c12d0f791…

MALICIOUS

PDF

74.2 KB Created: 2022-03-24 10:40:41 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-31
MD5: 969a10010c2119cfdc90646ade886dfe SHA-1: e3bf062cd1b470d5dfecf319e7dbccd7421fdb28 SHA-256: 5a1efe3c12d0f79134af27d5aa5849d6ff56f143e452a25fb8c0e626abfc397f
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ragaz.co.za/YmrXLWy8?keyword=narrative%20essay%20prompts%20for%207th%20grade PDF link annotation
    • https://sapakokejepudig.weebly.com/uploads/1/3/4/4/134457578/didakuv_xalofaben.pdfIn PDF document text
    • https://dixawofira.weebly.com/uploads/1/3/5/3/135303501/wabunawe.pdfIn PDF document text
    • https://fopizute.weebly.com/uploads/1/3/4/3/134315067/gabinupukajimiferux.pdfIn PDF document text
    • https://tesajezu.weebly.com/uploads/1/3/1/4/131452821/3b39f55e.pdfIn PDF document text
    • https://pakipetunora.weebly.com/uploads/1/3/4/8/134881281/ed0f412f.pdfIn PDF document text
    • https://kekisuganuzab.weebly.com/uploads/1/3/4/7/134721312/gixuvokifada_gepaz_pesarulijasapuv.pdfIn PDF document text
    • https://zoludapi.weebly.com/uploads/1/3/4/5/134528767/fawes-safatezekajawub-zapavuzoxe-dasapezesuri.pdfIn PDF document text
    • https://gimitowogavu.weebly.com/uploads/1/3/4/7/134746983/06e68a00.pdfIn PDF document text
    • https://wolimabapoz.weebly.com/uploads/1/4/1/2/141218080/bikuxiriletaz.pdfIn PDF document text
    • https://zogazipo.weebly.com/uploads/1/3/2/3/132303407/1195314.pdfIn PDF document text
    • https://pazuvokase.weebly.com/uploads/1/3/4/6/134615635/5977892.pdfIn PDF document text
    • https://nolipugi.weebly.com/uploads/1/3/4/6/134652161/vagilepidupulovuzade.pdfIn PDF document text
    • https://linugotozoluj.weebly.com/uploads/1/3/4/6/134662393/pozutex.pdfIn PDF document text
    • https://zipatusuf.weebly.com/uploads/1/3/4/0/134012633/xupen_tokinobe.pdfIn PDF document text
    • https://metazavog.weebly.com/uploads/1/3/4/6/134650383/texip_kidupumit_temomosafe.pdfIn PDF document text
    • https://mojivisosodarez.weebly.com/uploads/1/3/4/0/134096231/231519c850b.pdfIn PDF document text
    • https://wifaborasumekig.weebly.com/uploads/1/3/2/6/132695644/58f6a.pdfIn PDF document text
    • https://buziratefe.weebly.com/uploads/1/3/4/3/134354065/27b28e7.pdfIn PDF document text
    • https://gawowulovo.weebly.com/uploads/1/3/5/9/135966180/xidisasapabovu-savifep-wuxiza.pdfIn PDF document text
    • https://segojojozifad.weebly.com/uploads/1/3/4/3/134324481/4715558.pdfIn PDF document text
    • https://mifokidosunatav.weebly.com/uploads/1/3/0/9/130969664/gujepipi_ziwasivow.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c04f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC04F 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336
font_01_sfnt_off0000d6f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6F3 11000 bytes
SHA-256: b02d2cbcdd5f1bdfc5ac4b3ca6f7538e8caebf670591d4d0edf386eeeed56bc3
font_02_sfnt_off0000f06f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF06F 16364 bytes
SHA-256: b96b92a504e68bb541f39886dca12d80d4f436ceedca9a7a2caf7e5fd019c4e7

Open this report in the interactive analyzer, or submit your own file for analysis.