Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f3c085c309174e6…

MALICIOUS

PDF

303.0 KB Created: 2022-05-01 12:20:03 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-03
MD5: f88b6de4952dd3e69fcd48926fe64692 SHA-1: 2fa98909128a0d321eb867f90c8714850da186bc SHA-256: 5f3c085c309174e61b3220066bb7a51777ff68abab960eb1c9afa5d9dc2742a8
176 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6043

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://toxuxejegeze.weebly.com/uploads/1/3/5/3/135317786/sunepiru.pdf In PDF document text
    • https://bepusubo.weebly.com/uploads/1/3/0/8/130814017/6412c561379d1.pdfIn PDF document text
    • http://backtherapymattress.com/ckfinder/userfiles/files/vibuxamiromedotagipebixu.pdfIn PDF document text
    • https://myhoorayhealth.com/wp-content/plugins/super-forms/uploads/php/files/83e6ac2421f53c3e573d0ae161dab258/nerenuwimimazarulovogo.pdfIn PDF document text
    • https://telemoradez.weebly.com/uploads/1/3/1/0/131069753/ribulawewozexofit.pdfIn PDF document text
    • https://tagunodakaveb.weebly.com/uploads/1/3/4/8/134865504/d626f47.pdfIn PDF document text
    • https://nifibutadufino.weebly.com/uploads/1/4/1/3/141389428/1814459.pdfIn PDF document text
    • https://ketatesi.weebly.com/uploads/1/3/4/2/134234598/5362725.pdfIn PDF document text
    • https://demetraproject.eu/ckfinder/userfiles/files/1935834213.pdfIn PDF document text
    • https://fuxureriwixivo.weebly.com/uploads/1/3/0/7/130739224/woxuwulonu.pdfIn PDF document text
    • https://www.kpglearningbox.com/assets/kcfinder/upload/files/buritume.pdfIn PDF document text
    • https://gatobutapasi.weebly.com/uploads/1/3/4/3/134364099/74060a54.pdfIn PDF document text
    • http://lustigersteirer.at/userfiles/file/povakajiniroxapojoj.pdfIn PDF document text
    • https://terekutididir.weebly.com/uploads/1/3/0/9/130969195/5332588.pdfIn PDF document text
    • https://lubebubekawi.weebly.com/uploads/1/3/4/7/134714091/dizukavuse-xazibetogovi.pdfIn PDF document text
    • https://perfecthospitals.org/ckfinder/userfiles/files/3668008918.pdfIn PDF document text
    • https://kiwevewixupe.weebly.com/uploads/1/4/1/4/141406413/7357431.pdfIn PDF document text
    • https://hale-metalice.com/images/userfiles/43997233893.pdfIn PDF document text
    • http://e-sheremet.com/img/mimetedigomakogoligag.pdfIn PDF document text
    • https://durozuxazoxete.weebly.com/uploads/1/3/4/6/134647509/tomuxiluvetonusavux.pdfIn PDF document text
    • https://tabolejujabolo.weebly.com/uploads/1/3/2/6/132682899/kusegogemuwesimam.pdfIn PDF document text
    • https://dawunatebebi.weebly.com/uploads/1/3/1/4/131408224/756235.pdfIn PDF document text
    • https://nigenodesi.weebly.com/uploads/1/3/4/4/134480521/zovudo.pdfIn PDF document text
    • http://www.ppspr.org.br/ckeditor/kcfinder/upload/files/34871867117.pdfIn PDF document text
    • http://fruitsad.pl/images/file/dufulelolunabefiforere.pdfIn PDF document text
    • http://baheth24cars.com/ckfinder/userfiles/files/96390342201.pdfIn PDF document text
    • https://gugagefa.weebly.com/uploads/1/3/4/3/134343265/4269911.pdfIn PDF document text
    • https://szemere-iskola.hu/images/files/37147293604.pdfIn PDF document text
    • https://fomutifimo.weebly.com/uploads/1/3/4/5/134594787/d01a2c.pdfIn PDF document text
    • https://coevent.ru/upload/files/29869400430.pdfIn PDF document text
    • https://tamukatiraf.weebly.com/uploads/1/3/4/7/134766395/bidokofurugi.pdfIn PDF document text
    • https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/a8fe7cfee20b316c987e0e62c43d5712/julupomifuradaratelax.pdfIn PDF document text
    • https://dilefiwevesidon.weebly.com/uploads/1/3/7/5/137511967/3226519.pdfIn PDF document text
    • https://roxuxafuz.weebly.com/uploads/1/3/0/8/130813852/60f2c1.pdfIn PDF document text
    • https://volosodavebogo.weebly.com/uploads/1/3/4/8/134873809/7852835.pdfIn PDF document text
    • https://www.montferri.com/admin/js/plugins/kcfinder/upload/files/62956051329.pdfIn PDF document text
    • https://cowichanmusicfestival.com/userfiles/file/rosizefebavesivixososupim.pdfIn PDF document text
    • https://bold-iot.com/uploads/files/202203062230502176.pdfIn PDF document text
    • https://zixulelivu.weebly.com/uploads/1/3/4/5/134507035/047d928460d15f6.pdfIn PDF document text
    • https://tevav.co.za/XSRYdR1H?utm_term=google+chrome+77+for+windows+10PDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000445b7.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000445b7.bin)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000445b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x445B7 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00045dce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45DCE 11012 bytes
SHA-256: 3f1ca623683e89c7c5980ec5f85f1eda26eda9ecf742ceaba8d1fab773f6b470
font_02_sfnt_off00047723.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x47723 20664 bytes
SHA-256: 3708675f16d7c020dd555a9e8cabbfcfb0122256234ed20410ee4416d44544c6

Open this report in the interactive analyzer, or submit your own file for analysis.