PDF malware analysis — malicious · 5d8973f3f623bbd4

MALICIOUS

PDF

358.4 KB Created: 2022-02-05 08:07:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-18

MD5: b7daa7a0ab666ebb8664b364175a7b4f SHA-1: f1a7bfd6119ecb1c9cab51888d073fee19a2f5a8 SHA-256: 5d8973f3f623bbd47f548b98336d3b2a011d91ca068952d15daeef9dc9416661

136 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.6933

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lovig.co.za/XSRYdR1H?utm_term=casio+fx+991+ce+x+manual+cz PDF link annotation
- https://miminku5.com/contents/files/goruwutazewi.pdfIn PDF document text
- http://harringtonandlombardi.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/motuzezikegiw.pdfIn PDF document text
- https://xn--i1aam8cb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/de345b74d45224bb05ae7ce10c693432/29963487408.pdfIn PDF document text
- https://1000fdep.talenzsoftware.fr/upload/files/64910581229.pdfIn PDF document text
- http://lcs.edistrict.net/ckfinder/userfiles/files/8656159438.pdfIn PDF document text
- http://placidlakes.com/larpm/uploads/file/vefatunaginujupeso.pdfIn PDF document text
- http://ankamet.com/userfiles/file/jazulunixikupem.pdfIn PDF document text
- https://ikincielinmak.com/upload/ckfinder/files/77036252972.pdfIn PDF document text
- https://ip-pharma.net/data/files/kuditovibelaj.pdfIn PDF document text
- https://calson.garment-pro.com/ckfinder/userfiles/files/zomolota.pdfIn PDF document text
- https://grupo-kayros.com/userfiles/file/61652834150.pdfIn PDF document text
- http://chrmglobal.com/userfiles/file/954354343.pdfIn PDF document text
- https://www.cltservices.net/backoffice/kcfinder/upload/files/28473856170.pdfIn PDF document text
- https://bairesrivadavia.renault.cns.ultrait.com.ar/admin0km/kcfinder/upload/files/32999392948.pdfIn PDF document text
- http://jurabos.nl/include/editor/file/74191652775.pdfIn PDF document text
- http://htwy.com/upload/file/kegamalirabekerumiboriwi.pdfIn PDF document text
- http://asid.rw/userfiles/file/futerumedunazuboxuroli.pdfIn PDF document text
- https://dascalita.ro/app/webroot/files/userfiles/files/29853439176.pdfIn PDF document text
- https://www.funes.gob.ar/ckfinder/userfiles/files/wosivadamatovenanazuv.pdfIn PDF document text
- http://www.instalacionescueto.com/nueva/ckfinder/userfiles/files/8920648259.pdfIn PDF document text
- http://viethanit.vn/hinhanh/file/zudeluma.pdfIn PDF document text
- http://presssimayeshahr.ir/pic/file/93654704783.pdfIn PDF document text
- http://kaies.cn/upfiles/211205055746323276o5roy7.pdfIn PDF document text
- http://inimtrento.it/userfiles/files/75425540931.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000529ea.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x529EA	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_01_sfnt_off00054105.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x54105	19180 bytes
SHA-256: `62bd1455fbb8c4fb57a9b0e68bbcb9f40bc3066308f2ee3a538aea81a5555cb2`
`font_02_sfnt_off00057013.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x57013	10812 bytes
SHA-256: `64676d409751218e7ebbe794f71b0c7391c75f5e730662cbd459c688913cccd7`

Open this report in the interactive analyzer, or submit your own file for analysis.