Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dfa395a063dc29b…

MALICIOUS

PDF

402.5 KB Created: 2022-03-23 05:18:20 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-19
MD5: d34d442c3cbe8749062b151b50d48c06 SHA-1: ecb7cf47a97ea92825fa76872aa2d04d3f919306 SHA-256: 6dfa395a063dc29b860e36b72c9c6c46705c42b244be368bbffae67127e3b11a
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5598

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jingyitech.com/uploadfile/xivuwuzese.pdf In PDF document text
    • http://sbsinternationalschool.org/userfiles/file/4748395755.pdfIn PDF document text
    • http://ex2010.com/uploadfile/file/2022022500504873499.pdfIn PDF document text
    • http://www.politico.cnm.org.br/ckeditor_custom/kcfinder/upload/files/2524646984.pdfIn PDF document text
    • http://pietroquatriniarchitetto.eu/userfiles/files/widakikufiterapatotin.pdfIn PDF document text
    • https://lawtutors.co.uk/js/ckfinder/userfiles/files/ruredoravegudiguzagivi.pdfIn PDF document text
    • http://slr-eyewear.com/slr/userfiles/20220208141913.pdfIn PDF document text
    • http://dochoiotovn.com/uploads/userfiles/file/lidazipebuditosivapiw.pdfIn PDF document text
    • http://falconartistmanagement.com/ckfinder/userfiles/files/gesutafapivere.pdfIn PDF document text
    • http://hutnia.pl/userfiles/file/gewup.pdfIn PDF document text
    • http://zhongjiukeji.com/upload_fck/file/2022-3-2/20220302080604766664.pdfIn PDF document text
    • https://ibrahimkoc.com/images/Media/files/zepoweron.pdfIn PDF document text
    • https://simplehome.ro/ckfinder/userfiles/files/73748531924.pdfIn PDF document text
    • http://jevades.com/aircraft/fckimages/file/pigonumesujeturezefowi.pdfIn PDF document text
    • http://hilimall.ae/uploads/files/sigivutibolomuvije.pdfIn PDF document text
    • http://www.aamuhsv-madisonalumni.org/files/files/61005633602.pdfIn PDF document text
    • https://www.sussexweddingservices.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1622d7a2eb5825---90876381587.pdfIn PDF document text
    • https://happycpdl.com/backend/web/kcfinder/upload/files/dugaronob.pdfIn PDF document text
    • http://thuephotocopytaihanoi.com/upload/files/29072953157.pdfIn PDF document text
    • http://rbmtechnik.pl/userfiles/file/feximox.pdfIn PDF document text
    • http://aibrpjoaae2.specialty-match.com/upload/files/padabojajuwogato.pdfIn PDF document text
    • https://espiber.misitioexpress.com/images/uploadedimages/file/rapiwowamijetagazivomano.pdfIn PDF document text
    • https://xylemleads.com/userfiles/file/sepanepagiriw.pdfIn PDF document text
    • http://mvpvo.ru/userfiles/file/lifiv.pdfIn PDF document text
    • http://papinchess.ru/userfiles/file/tikew.pdfIn PDF document text
    • http://rosspeed.com/kcfinder/upload/files/wasavoramujoroxovis.pdfIn PDF document text
    • https://adilakaryakitnakliyat.com/kcfinder/upload/files/70319739415.pdfIn PDF document text
    • https://pakistanchristiancongress.org/userfiles/file/55087392936.pdfIn PDF document text
    • https://inprovituruguay.com/ckfinder/userfiles/files/maxap.pdfIn PDF document text
    • http://technimexvn.com/images/ckeditor/files/moxeritololijigupawuk.pdfIn PDF document text
    • https://ask-it.softki.com/Ask-it/UserFiles/file///25732896808.pdfIn PDF document text
    • http://goupcrm.com.br/kcfinder/upload/files/39528516587.pdfIn PDF document text
    • http://www.jatekkalmesevel.hu/admin/ckeditor/kcfinder/upload/files/65395177602.pdfIn PDF document text
    • http://sochi-vitrazhi.ru/ckfinder/userfiles/files/47460160957.pdfIn PDF document text
    • https://avantkart.com/wp-content/plugins/super-forms/uploads/php/files/r24ptm5bcdp8b3b9f8dgs9mppn/gedezekafuzife.pdfIn PDF document text
    • http://www.thelawchamber.com/wp-content/plugins/formcraft/file-upload/server/content/files/162360b3b9f974---fewobavinilerulolotegafo.pdfIn PDF document text
    • http://gysanya.com/upload/file/220207121334240766jd1dx9cekms2.pdfIn PDF document text
    • https://mkserwis.pl/userfiles/file/dixegubigobufosasilojuzi.pdfIn PDF document text
    • https://nisseiplastic.com/up_images/exp/files/doretoxikavokevaxixapikaz.pdfIn PDF document text
    • http://for-man-woman.ru/userfiles/files/padufugusevepikun.pdfIn PDF document text
    • http://3mfa.com/images/editor/files/80620933237.pdfIn PDF document text
    • http://giovanniseneca.eu/userfiles/files/46326325620.pdfIn PDF document text
    • https://komodovo.ru/upload_picture/68549065524.pdfIn PDF document text
    • http://torremaggiore.sitmap.it/files/files/65972028713.pdfIn PDF document text
    • http://infrabud.eu/fckpliki/file/nutivubaberep.pdfIn PDF document text
    • https://lovig.co.za/XSRYdR1H?utm_term=spartacus+all+season++480pPDF link annotation
    • https://ceb.lk/assets/js/kcfinder/upload/files/wozodiso.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    +5 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005d499.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D499 19832 bytes
SHA-256: 4523231a356e349db60e4769ce0f7d66476dd2be7cec56e68bdc768cbdb72f9d
font_01_sfnt_off0006088f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6088F 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_02_sfnt_off00061fba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61FBA 10856 bytes
SHA-256: 4861dcc43973289b76a9f71c21e032527d190c2770a49d25fcdcf9fe7c5cc34a