Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d82e139c8824945…

MALICIOUS

PDF

93.4 KB Created: 2022-04-06 18:45:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-18
MD5: 25ebbf01e6c5b9cfc478efc58cb40d7e SHA-1: 0ce573579d1d0d7fbaaec2d13536d3937be969da SHA-256: 5d82e139c88249457f3cbb74c587c5634bfd24c6676e269f3f79ae82b5b63b14
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/YmrXLWy8?keyword=red%20skull%203d%20puzzle%20instructions PDF link annotation
    • https://skyfireconsulting.com/wp-content/plugins/super-forms/uploads/php/files/bpieddge6sbho4chjko49eo0hd/paxomuviwiluk.pdfIn PDF document text
    • https://gulceoyunlar.com/calisma2/files/uploads/68770494008.pdfIn PDF document text
    • https://sosegesidor.weebly.com/uploads/1/3/4/4/134465043/dezawaxataweso.pdfIn PDF document text
    • https://xajaxosu.weebly.com/uploads/1/3/5/3/135304217/pifexetureze-fijirafeke-liburuwos-xiniki.pdfIn PDF document text
    • https://thietkeweblongan.com/upload/files/91925253935.pdfIn PDF document text
    • https://webgirls-studio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620112a4c891c---badisutenekudonus.pdfIn PDF document text
    • https://www.invidea.it/kcfinder/upload/files/36002733739.pdfIn PDF document text
    • https://cmri.ckbirlahospitals.com/controlpanel/kcfinder/upload/files/porigusoxofuroxoxiji.pdfIn PDF document text
    • http://koppeika.ru/userfiles/file/25905131382.pdfIn PDF document text
    • https://xixodojele.weebly.com/uploads/1/3/4/3/134375941/b6b7823c329a.pdfIn PDF document text
    • http://smartvoicecom.com/userfiles/vagixemuwuwobakenoroz.pdfIn PDF document text
    • http://kutyakozmetikustanfolyam.hu/kcfinder/upload/files/67754350920.pdfIn PDF document text
    • https://wekopigigosem.weebly.com/uploads/1/3/4/5/134503853/fatojupupikimu_lepaxusojifilix.pdfIn PDF document text
    • https://dogopakuva.weebly.com/uploads/1/3/4/6/134698139/2587137.pdfIn PDF document text
    • http://thepducphat.com/upload/files/xodupifuvi.pdfIn PDF document text
    • http://tecniagua.es/uploads/ckfinder/files/60232677347.pdfIn PDF document text
    • https://cosmopolitanhotelbg.lastrada.bg/uploads/wysiwyg/files/rimivame.pdfIn PDF document text
    • https://rawuvuxa.weebly.com/uploads/1/3/4/0/134019107/f845e9b5c1e0e56.pdfIn PDF document text
    • https://viserewisesu.weebly.com/uploads/1/3/4/8/134886384/mudifininetemapaj.pdfIn PDF document text
    • https://vexapezerizerup.weebly.com/uploads/1/3/4/7/134717078/3459512.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010520.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10520 19108 bytes
SHA-256: 264096e9ba37a997ebe5cbc3dad5c37e07b3f1ca484e5a1ffb5d3ce4c81a36c0
font_01_sfnt_off00013610.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13610 10816 bytes
SHA-256: caf4a1614bd63819c6eaf5d29ba8886de242c2eefa907fd5499957ebe8ba7800
font_02_sfnt_off00014f3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14F3A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.