Malicious PDF — malware analysis report

Static analysis result for SHA-256 7261e923bbb50cfd…

MALICIOUS

PDF

400.4 KB Created: 2022-04-14 12:10:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-11
MD5: 3a0ca43e3a934b4972fe01598764238e SHA-1: 983fadf57011407d9b6505e9c1256cb7b82d343f SHA-256: 7261e923bbb50cfd7cb5457e3d40bf0fe7b4cac6a105a57bb5780a9a8cfad62c
166 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7309

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/XSRYdR1H?utm_term=computer+acronyms+list+and+definitions+pdf PDF link annotation
    • http://gezond-trakteren.nl/kasteel-doornenburg-img/bestandenfile/60160254685.pdfIn PDF document text
    • https://buderenedisam.weebly.com/uploads/1/3/5/3/135302361/jaruzag-wedaj-fusefupaboxunej.pdfIn PDF document text
    • https://egca.fr/userfiles/file/temekudikotefesowe.pdfIn PDF document text
    • http://apart1day.ru/file/sejejexat.pdfIn PDF document text
    • https://watosaphotography.com/app/webroot/userfiles/files/20220326_062820.pdfIn PDF document text
    • https://xiligori.weebly.com/uploads/1/3/1/4/131411896/9069658.pdfIn PDF document text
    • http://adm-zhemtala.ru/files/files/76525043820.pdfIn PDF document text
    • http://chpcentre.com/files/file/85521863918.pdfIn PDF document text
    • https://vasodekomupu.weebly.com/uploads/1/4/1/3/141375701/nafuv.pdfIn PDF document text
    • http://www.atccs3.it/atccs3/fckeditor/editor/ckfinder/userfiles/files/46937418579.pdfIn PDF document text
    • http://www.fashiongale.ro/userfiles/files/xipodomekarolazumetawuzuz.pdfIn PDF document text
    • https://braus.uz/images/shared/file/89774568756.pdfIn PDF document text
    • https://zegepefuloruwan.weebly.com/uploads/1/3/4/0/134012378/xibutakowu.pdfIn PDF document text
    • https://mannerfeltdesignteam.se/ckfinder/userfiles/files/wegofopobatisisamapuw.pdfIn PDF document text
    • https://suduwigopoda.weebly.com/uploads/1/3/4/5/134587425/bikonobu_dirujupi_febapeturo_sivufepej.pdfIn PDF document text
    • http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1623874ce52572---72769475895.pdfIn PDF document text
    • https://lonodoxelu.weebly.com/uploads/1/3/4/3/134305804/2f87a.pdfIn PDF document text
    • https://www.bountyvacation.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620d8c7f2a5ca---21823252564.pdfIn PDF document text
    • https://relupopakamon.weebly.com/uploads/1/3/4/4/134455445/3737813.pdfIn PDF document text
    • http://cadelupo.it/userfiles/files/bevixipozedanurimunajuju.pdfIn PDF document text
    • https://tazeviguso.weebly.com/uploads/1/3/4/3/134339516/8286917.pdfIn PDF document text
    • https://zelidewa.weebly.com/uploads/1/3/4/3/134371532/1333393.pdfIn PDF document text
    • http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/162015d780f81d---bowamiduluxubalapukek.pdfIn PDF document text
    • https://tetisawemovuzin.weebly.com/uploads/1/4/1/3/141328914/telomor.pdfIn PDF document text
    • https://wlao.on.ca/wp-content/plugins/super-forms/uploads/php/files/121716cdd346cb0cec260f5160498462/75038800089.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0005d1b2.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0005d1b2.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005d1b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D1B2 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0005e9c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E9C9 11024 bytes
SHA-256: 819a5fd0159b4f6d5dcca59fef26188b43b58d717a4c26eab97ba861a877a9d1
font_02_sfnt_off00060372.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60372 18232 bytes
SHA-256: d93c35e90f84e8d2e21c4a2c7a04b76a6e7f7cbfe2807b7ab8873e87286b7081