Malicious PDF — malware analysis report

Static analysis result for SHA-256 6df3f374d36a1649…

MALICIOUS

PDF

550.5 KB Created: 2022-05-12 07:28:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-19
MD5: 95fd5c31acd8562ffe23a2c9640612ad SHA-1: a5aa6b1d77f9e116972113163b1781fef1326947 SHA-256: 6df3f374d36a16490ade96870e4dc5074471ded9305537263ccd7470155c6daa
166 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2917

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wirut.co.za/XSRYdR1H?utm_term=third+conditional+conversation+questions+pdf++torrent+download PDF link annotation
    • http://svb-volleyball.de/userfiles/file/63943461196.pdfIn PDF document text
    • https://xopusetimova.weebly.com/uploads/1/3/4/1/134108877/didejazanedos.pdfIn PDF document text
    • https://maria-galland.ru/files/file/52280220370.pdfIn PDF document text
    • http://studiovalentini.eu/userfiles/files/dunedanofuxil.pdfIn PDF document text
    • http://professionalcsali.hu/admin/ckeditor/kcfinder/upload/files/vuvapigezetido.pdfIn PDF document text
    • https://samsungdvmklima.com/upload/ckfinder/files/wagabituwezibofifuwani.pdfIn PDF document text
    • https://lomodujumozib.weebly.com/uploads/1/3/4/5/134588848/f051309e96f9.pdfIn PDF document text
    • https://fofomakizu.weebly.com/uploads/1/3/0/7/130775640/a67ad76080cb.pdfIn PDF document text
    • https://fevolubepekero.weebly.com/uploads/1/3/2/3/132303134/84285b.pdfIn PDF document text
    • https://pibemalogodozod.weebly.com/uploads/1/3/2/6/132681910/kaxugabemekab_venedebozorobiv_senibojima.pdfIn PDF document text
    • http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/162498b7bd24d9---85634169136.pdfIn PDF document text
    • http://skncn.com/u/files/60609479439.pdfIn PDF document text
    • https://pafirovax.weebly.com/uploads/1/3/4/6/134662293/remojigezo.pdfIn PDF document text
    • https://mexavabawidusa.weebly.com/uploads/1/3/4/3/134375000/vumik.pdfIn PDF document text
    • https://zabidikigez.weebly.com/uploads/1/3/4/5/134594795/dikeje_vakin.pdfIn PDF document text
    • https://romasagato.weebly.com/uploads/1/3/4/7/134723475/rirew-dupulaku-divozuw-kasajawanufew.pdfIn PDF document text
    • http://ryukatsu.com/userData/board/file/97232979063.pdfIn PDF document text
    • http://aucoindeshalles.com/menu/file/xodiporixotegudixu.pdfIn PDF document text
    • https://vowuzuvave.weebly.com/uploads/1/3/4/8/134884034/9008448.pdfIn PDF document text
    • https://fokinovev.weebly.com/uploads/1/3/0/7/130775288/1e600c6a0b1a.pdfIn PDF document text
    • https://www.lacasadeltecle.com/imagenes/editor/file/69224513387.pdfIn PDF document text
    • http://www.zendogbeds.cz/products/files/podoteponef.pdfIn PDF document text
    • https://fejatifa.weebly.com/uploads/1/4/1/5/141513712/ramezufoguw.pdfIn PDF document text
    • http://arndt-fahrschule.de/userfiles/file/1889948878.pdfIn PDF document text
    • https://nexiwurepefisov.weebly.com/uploads/1/3/4/3/134372078/gaxupeli-vomexukepuza-naguz-finijakolopunu.pdfIn PDF document text
    • https://jegobegopij.weebly.com/uploads/1/3/1/8/131871729/lesepupok.pdfIn PDF document text
    • https://gebejisidimi.weebly.com/uploads/1/3/5/3/135302949/5cf38.pdfIn PDF document text
    • https://ranoxezumurew.weebly.com/uploads/1/3/5/3/135345736/velojezuzaxon_karujefinafuf_bagabobonun.pdfIn PDF document text
    • https://vezejajanobel.weebly.com/uploads/1/3/1/6/131606482/rituwibegotup-lanulo-daserilurarep-padesike.pdfIn PDF document text
    • http://harissarantis.com/userfiles/files/ronopabowipifa.pdfIn PDF document text
    • https://5points.com.ng/5points-admin/kcfinder/upload/files/22663078287.pdfIn PDF document text
    • http://okinawa-touch.com/app/webroot/js/kcfinder/upload/files/bifekejisibukisori.pdfIn PDF document text
    • http://theindianaccountant.com/pa/trainstation/uploads/image/file/rizeriwikobixelejij.pdfIn PDF document text
    • http://mdbim.pl/ubezpiecz/obrazy/file/62850634860.pdfIn PDF document text
    • https://mukapilekukut.weebly.com/uploads/1/3/4/4/134478908/81f3a3136de.pdfIn PDF document text
    • https://liritetujom.weebly.com/uploads/1/3/5/3/135310948/wibeviwewenizezinipe.pdfIn PDF document text
    • https://kajinazesutip.weebly.com/uploads/1/3/4/8/134888738/69572.pdfIn PDF document text
    • https://danabemove.weebly.com/uploads/1/3/0/7/130776083/2199791.pdfIn PDF document text
    • https://zogazakuf.weebly.com/uploads/1/3/1/6/131636678/9a508a6e13611f.pdfIn PDF document text
    • http://chinalabware.net/d/files/32461428234.pdfIn PDF document text
    • https://solupebasil.weebly.com/uploads/1/3/5/9/135972399/8641736.pdfIn PDF document text
    • https://pesilukijirizi.weebly.com/uploads/1/3/4/8/134864792/f85b47a6161768.pdfIn PDF document text
    • https://zarobagi.weebly.com/uploads/1/4/1/2/141219729/4165074.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    +2 more URL(s)
🗂 Part of campaign: shared payload 3bdaa38ad0 3 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000813fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x813FA 11076 bytes
SHA-256: c7546d7431e86894a8374a2e8e3172da4d494da114ea45b0b4defef223188532
font_01_sfnt_off00082d97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82D97 20744 bytes
SHA-256: 50ae1ee09a8f40565ebb67d8651256085c8d333ca862d0bfb0562a7b497c4833
font_02_sfnt_off00086240.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86240 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_03_sfnt_off00087a59.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87A59 3468 bytes
SHA-256: 3bdaa38ad0f520e048b9f96608f95f993c2d2784798f3a1da719d41b35acc822

Open this report in the interactive analyzer, or submit your own file for analysis.