Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d3dd3463b3c946d…

MALICIOUS

PDF

261.1 KB Created: 2022-04-06 15:58:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-16
MD5: 8dbd9adeca61d911d207c8347dca8c77 SHA-1: 0dfc600ad58d333acc876c082951dbbf01f7f53a SHA-256: 5d3dd3463b3c946d9094882b77bf519d6345de0ddd9f6a5016c362f22ae0677d
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7035

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dns1.lineshare.net/upload/files/20220401190443.pdf In PDF document text
    • https://juvosibizojeguw.weebly.com/uploads/1/3/4/0/134040958/silexerox.pdfIn PDF document text
    • https://zetejuxir.weebly.com/uploads/1/3/4/3/134338478/5373755.pdfIn PDF document text
    • https://bojuzogonugux.weebly.com/uploads/1/3/5/3/135304036/1020b47522de.pdfIn PDF document text
    • https://mojipakubi.weebly.com/uploads/1/3/4/6/134679558/2931685.pdfIn PDF document text
    • http://josquin-capella.de/download/jesibenobofukekepize.pdfIn PDF document text
    • http://writtenmail.com/upload_images/file/77023562691.pdfIn PDF document text
    • https://fuvokejab.weebly.com/uploads/1/4/1/2/141255946/bakivazasulet.pdfIn PDF document text
    • https://bejasesazopo.weebly.com/uploads/1/3/4/5/134512805/sanuligo.pdfIn PDF document text
    • https://valijobeguxufa.weebly.com/uploads/1/3/4/1/134108929/pipejomuxus_konulenijuk_pejajis.pdfIn PDF document text
    • https://sibois.eu/userfiles/file/49135166055.pdfIn PDF document text
    • https://dorakipep.weebly.com/uploads/1/3/4/7/134747047/4869292.pdfIn PDF document text
    • http://dentalweek.eu/userfiles/files/pufikumatezazi.pdfIn PDF document text
    • http://moje-stranky.eu/userfiles/file/29745541931.pdfIn PDF document text
    • https://bewulikafujisew.weebly.com/uploads/1/3/5/3/135326730/2140880.pdfIn PDF document text
    • https://xilivixawigilu.weebly.com/uploads/1/3/4/6/134672458/wepuz.pdfIn PDF document text
    • https://dajedenutiwifux.weebly.com/uploads/1/3/4/3/134318988/disadajofotoxuwolaj.pdfIn PDF document text
    • https://gebedosoxabitox.weebly.com/uploads/1/3/5/3/135324181/dolezij.pdfIn PDF document text
    • https://kekebamifibem.weebly.com/uploads/1/3/1/6/131606854/5500053.pdfIn PDF document text
    • https://siwuretigi.weebly.com/uploads/1/3/4/3/134319511/db1b0.pdfIn PDF document text
    • https://gokejubekilebu.weebly.com/uploads/1/3/4/3/134376129/korowizob-sukuvetelilabo.pdfIn PDF document text
    • https://pesadosopovito.weebly.com/uploads/1/3/4/2/134235692/vewezinumulaka-subipuponokawu.pdfIn PDF document text
    • http://resetimpianti.it/reset/public/file/mugonimuvepurubub.pdfIn PDF document text
    • https://zibozofos.weebly.com/uploads/1/3/4/8/134896422/kepuxesobeluwikofu.pdfIn PDF document text
    • https://donokodupotev.weebly.com/uploads/1/3/4/3/134317189/jejuvitunazoxenaxer.pdfIn PDF document text
    • https://sunuf.co.za/XSRYdR1H?utm_term=circulo+dividido+en+9PDF link annotation
    • https://bimozasobo.weebly.com/uploads/1/3/1/3/131398313/4101010.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0003a144.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0003a144.bin)

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003a144.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A144 10300 bytes
SHA-256: 6e5c7e0fb4f99426d982977901118ed67fbc0736ae280eeaef6bb18b42a2eeb6
font_01_sfnt_off0003b899.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B899 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0003d0ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D0AB 21076 bytes
SHA-256: 826a38fc521e2c8b3cd2b33e5bce377853a1a461a3165d75f0158ce34bda9d19

Open this report in the interactive analyzer, or submit your own file for analysis.