Malicious PDF — malware analysis report

Static analysis result for SHA-256 67d4b4fc7179ce55…

MALICIOUS

PDF

316.2 KB Created: 2022-04-03 23:31:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-02
MD5: dedd4545652bd1beb2b1831118e708be SHA-1: 2628320eba28babd1fb3bf8a37fef7133defe213 SHA-256: 67d4b4fc7179ce55af12ee7e6809dbc570d7881b0ae04649b637d3b2fa8d654e
176 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8931

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=need+for+speed+hot+pursuit+trainer+lingon PDF link annotation
    • https://dafizoxov.weebly.com/uploads/1/3/5/3/135309439/lajolaguwunajefoka.pdfIn PDF document text
    • https://www.arphplumbing.co.uk/wp-content/plugins/super-forms/uploads/php/files/f0eh557ib4fai45sttoj18tl7s/govoxakesizugatuka.pdfIn PDF document text
    • https://ruwadegefanum.weebly.com/uploads/1/3/4/1/134108857/pavorifatomekudu.pdfIn PDF document text
    • https://xuniruki.weebly.com/uploads/1/3/0/7/130739043/81e817c784448b1.pdfIn PDF document text
    • https://www.drukwerkmax.nl/public/admin/assets/global/plugins/kcfinder/upload/files/zoviberopex.pdfIn PDF document text
    • https://motapesuna.weebly.com/uploads/1/3/4/7/134749044/jewekajofege_jefasi.pdfIn PDF document text
    • https://logezunax.weebly.com/uploads/1/4/1/3/141315045/zatawajikupe.pdfIn PDF document text
    • https://iesvegadesanjose.mrueno.com/userfiles/file/kexitagufox.pdfIn PDF document text
    • https://komipakokituk.weebly.com/uploads/1/3/5/9/135993761/pupakijaromaxupej.pdfIn PDF document text
    • http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/162424f8bf3c57---sanejutija.pdfIn PDF document text
    • http://chestheart.org/journal/assets/ckeditor/kcfinder/upload/files/88142363443.pdfIn PDF document text
    • https://dilemawusufugo.weebly.com/uploads/1/3/0/8/130874642/pilebojepazare-bupikefesoto-kariri-vureped.pdfIn PDF document text
    • https://jexepasevotapak.weebly.com/uploads/1/3/1/6/131606223/dcb0e7.pdfIn PDF document text
    • https://nagipunewemog.weebly.com/uploads/1/3/5/3/135315215/vazebugejegukexa.pdfIn PDF document text
    • http://aquaview.net/uploads/assets/files/pipulofozabamonefipo.pdfIn PDF document text
    • http://pattarasawat.com/ckfinder/userfiles/files/dolifipegeloxawojan.pdfIn PDF document text
    • http://4998horo.gmmwireless.com/contents/files/92605445013.pdfIn PDF document text
    • https://innotek.vn/uploads/news_file/pudolewubawixipugu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004827a.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004827a.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004827a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4827A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00049a8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x49A8C 17872 bytes
SHA-256: 442df73a7a28cf9aef3172e4fc36fa3f153b44e0e51d40e1fd39a804a0a78238
font_02_sfnt_off0004c94b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C94B 10856 bytes
SHA-256: a856b2d9113889bf2e1d4999ec736abb4f3af36fd29aafcc975212332fd25b4e

Open this report in the interactive analyzer, or submit your own file for analysis.