PDF static analysis report

Static analysis result for SHA-256 6607493eb9036a05…

SUSPICIOUS

PDF

403.7 KB Created: 2022-06-25 03:49:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-25
MD5: 1284169a33f14efbcce4e5d7ca921e37 SHA-1: 320b486938590d07e724b348e7891ce93e3edebe SHA-256: 6607493eb9036a050f68ce605a2f7ab061acb23bada86fdbf2abd6c563fe5f6c
46 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4984

Heuristics 4

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ragaz.co.za/XSRYdR1H?utm_term=fingerstyle+blues+exercises+for+beginners+sheet+music+pdf+download PDF link annotation
    • https://gematisi.weebly.com/uploads/1/3/4/5/134599806/wujemakabumev.pdfIn PDF document text
    • https://zetoruribafepa.weebly.com/uploads/1/3/1/4/131452904/muvizama.pdfIn PDF document text
    • http://mobilaide.com/upload/editor/file/jamopevufeb.pdfIn PDF document text
    • https://juliraviwuziw.weebly.com/uploads/1/3/4/2/134267057/rosamonafukuduxedu.pdfIn PDF document text
    • https://ketulujuzix.weebly.com/uploads/1/3/4/6/134649002/f112a3108.pdfIn PDF document text
    • https://luwojefera.weebly.com/uploads/1/4/1/4/141496796/8284438.pdfIn PDF document text
    • http://goupcrm.com.br/kcfinder/upload/files/13216747760.pdfIn PDF document text
    • https://bijuvija.weebly.com/uploads/1/3/5/3/135306534/5723007.pdfIn PDF document text
    • https://doketilid.weebly.com/uploads/1/3/4/5/134529618/3921635.pdfIn PDF document text
    • https://fuzaterolipi.weebly.com/uploads/1/3/1/4/131438829/jeben_pedovoku.pdfIn PDF document text
    • https://bizimivuwojojam.weebly.com/uploads/1/4/1/2/141279710/muzimuvalodugujuwo.pdfIn PDF document text
    • https://cauthinh.com/luutru/files/rofagafibutogozujojik.pdfIn PDF document text
    • https://rejobasagiletez.weebly.com/uploads/1/3/4/6/134642313/mupasusesijutiti.pdfIn PDF document text
    • https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16235efd6c6cbf---gizebavusetexuto.pdfIn PDF document text
    • https://regujume.weebly.com/uploads/1/3/4/3/134339948/347841.pdfIn PDF document text
    • https://tegeluvosuvu.weebly.com/uploads/1/3/4/8/134873603/c2dcf93badcd5ff.pdfIn PDF document text
    • https://jobugatiponez.weebly.com/uploads/1/3/4/2/134234820/wukepetogusoxuwo.pdfIn PDF document text
    • https://kilexudu.weebly.com/uploads/1/3/5/3/135347894/nigox.pdfIn PDF document text
    • https://xalekosud.weebly.com/uploads/1/3/5/3/135350534/1f3a5.pdfIn PDF document text
    • https://budezoguvuvos.weebly.com/uploads/1/4/1/7/141742358/mapafimoz-dobolalifibudop-tapobobireda.pdfIn PDF document text
    • https://baxomowimesadud.weebly.com/uploads/1/3/5/3/135303612/xewituwomov_bidovabix_lejufivumef.pdfIn PDF document text
    • https://pizojiri.weebly.com/uploads/1/3/4/6/134651663/e5330b14352edb4.pdfIn PDF document text
    • https://lonexuganaj.weebly.com/uploads/1/3/1/8/131856054/zatovi_rowobititinaxi_vomabiwenugipiz.pdfIn PDF document text
    • https://diniwujek.weebly.com/uploads/1/4/1/3/141386465/lamejavedule-busitu-xogowix.pdfIn PDF document text
    • https://mivezariwib.weebly.com/uploads/1/3/4/5/134582287/9627727.pdfIn PDF document text
    • https://wuduzavuvavazi.weebly.com/uploads/1/3/4/6/134618101/limabiwi_wasilajovogesa_sodazosorixupon.pdfIn PDF document text
    • https://tigigefudufabu.weebly.com/uploads/1/4/1/3/141335798/c834c21c6.pdfIn PDF document text
    • https://wilsonbarrera.com/inicio/wp-content/plugins/formcraft/file-upload/server/content/files/1620d902eba333---bajejojitesofebitis.pdfIn PDF document text
    • http://holflorstudio1.cz/upload/files/87821114670.pdfIn PDF document text
    • https://logosomuzabi.weebly.com/uploads/1/3/0/9/130969340/pawomemeguzesu_gonurem_zawalogekisuvap_ditunokebip.pdfIn PDF document text
    • http://bouwbedrijfansing.nl/userfiles/file/wojitavoxorojijilutugufi.pdfIn PDF document text
    • https://sasekevo.weebly.com/uploads/1/4/1/6/141633629/3277144.pdfIn PDF document text
    • https://www.d-table.com/wp-content/plugins/super-forms/uploads/php/files/bf53767503ec1cf3719a3839bab49c20/54257816928.pdfIn PDF document text
    • https://dozogifelezu.weebly.com/uploads/1/3/4/3/134313369/1490670.pdfIn PDF document text
    • https://votilolezin.weebly.com/uploads/1/3/4/3/134307270/29998.pdfIn PDF document text
    • https://lekodapodigix.weebly.com/uploads/1/3/4/5/134500142/vexizuwitare-benebowusovuvu.pdfIn PDF document text
    • https://dutorulepozog.weebly.com/uploads/1/4/1/3/141348236/1455404.pdfIn PDF document text
    • https://watepiwod.weebly.com/uploads/1/3/2/7/132710700/86be1e899eff.pdfIn PDF document text
    • https://zojuwovojujomib.weebly.com/uploads/1/4/1/3/141319281/ecf81a7ce5834.pdfIn PDF document text
    • https://zuzumapi.weebly.com/uploads/1/3/4/3/134344149/d4aee8fcc.pdfIn PDF document text
    • http://avrasyated.org/nedmin/production/ckeditor/kcfinder/upload/files/xalurulerituzisapibof.pdfIn PDF document text
    • http://domainecomps.com/documents/files/xejufa.pdfIn PDF document text
    • https://nigifizalajiwa.weebly.com/uploads/1/4/1/4/141411119/wabaxewijetisa_fivabag.pdfIn PDF document text
    • https://rotaruwuzuk.weebly.com/uploads/1/3/4/3/134317315/fefinasu-wizavatuzonavo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    +3 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005b0a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B0A3 18652 bytes
SHA-256: 9705626f8ed49b45e8a3acbe1fa8e6bf8aec8d23ed0839e3ff4ae988c1b2666f
font_01_sfnt_off0005e105.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E105 13352 bytes
SHA-256: 66dbe36da1178b5eff0fe7bfc5823b01a6ef73a9eeefcb0eb5c2e37ac8a3ddcf
font_02_sfnt_off00060978.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60978 11588 bytes
SHA-256: 253ca6f4b858647891a69dd5fa4a2673fe3ae280d4f75b5cf60d87ffc7f50549
font_03_sfnt_off00062481.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62481 16872 bytes
SHA-256: 46af3c5bbf8b0705e39ff197e01a7a39bfcff056228bf38c92353e1e2c431532

Open this report in the interactive analyzer, or submit your own file for analysis.