Malicious PDF — malware analysis report

Static analysis result for SHA-256 72b1af6cf17be894…

MALICIOUS

PDF

357.1 KB Created: 2022-04-18 22:26:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-28
MD5: 5f5b15f61ec36eb116c3e189b4843fd9 SHA-1: 8b30ef34ff3a2b0798ff141c69a0d73a4101dcf6 SHA-256: 72b1af6cf17be894f78c620de8c5cf8a8fdc186f0ba63210d1e9fdaa56db00da
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6763

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://podar.co.za/XSRYdR1H?utm_term=advantages+of+internet+pdf PDF link annotation
    • http://imhyuk.com/imhyukeditor/userfile/file/xutajogopawutevoguberoro.pdfIn PDF document text
    • http://alexdisinfestazioni.com/userfiles/files/xuneragamime.pdfIn PDF document text
    • https://vasigigu.weebly.com/uploads/1/3/4/6/134607878/3102752.pdfIn PDF document text
    • http://skrutit-probeg.ru/upload_picture/file/zutesam.pdfIn PDF document text
    • https://fulugive.weebly.com/uploads/1/3/0/8/130874350/bebca.pdfIn PDF document text
    • https://meritogaxubov.weebly.com/uploads/1/3/4/7/134767100/jupunipoluzav.pdfIn PDF document text
    • http://timandlor.com/userfiles/file/79421039390.pdfIn PDF document text
    • http://isped.net/kcfinder/upload/files/13835578753.pdfIn PDF document text
    • https://www.superioreagle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1623e11aca29f5---40961340569.pdfIn PDF document text
    • http://www.weilandensemble.nl/ckfinder/userfiles/files/dupafobuk.pdfIn PDF document text
    • https://jimitorivav.weebly.com/uploads/1/3/4/8/134878901/5de14bdbc76.pdfIn PDF document text
    • https://lowezikalazana.weebly.com/uploads/1/3/0/9/130969016/c1827e3b5c.pdfIn PDF document text
    • https://dxline.eu/userfiles/file/28947125804.pdfIn PDF document text
    • https://lijasefevofik.weebly.com/uploads/1/3/4/8/134889997/2879702.pdfIn PDF document text
    • http://0851gay.org/userfiles/202202file/2022021403531370554.pdfIn PDF document text
    • https://miguzunenamokuw.weebly.com/uploads/1/4/1/2/141256448/847f155232.pdfIn PDF document text
    • https://dlt-nkp.com/fileupload/file/21854041788.pdfIn PDF document text
    • https://vabofofed.weebly.com/uploads/1/3/4/3/134337048/6743899.pdfIn PDF document text
    • https://sisuveraxom.weebly.com/uploads/1/3/2/7/132740665/vizimuwibikag-wuwuleku-pijopef.pdfIn PDF document text
    • https://wiskind.com/filespath/files/20220326180858.pdfIn PDF document text
    • https://sojiguverapigiw.weebly.com/uploads/1/3/4/0/134017811/7374421.pdfIn PDF document text
    • https://www.crosstownnews.in/kcfinder/upload/files/duwazadenogigulinuterepi.pdfIn PDF document text
    • https://repavubujog.weebly.com/uploads/1/3/4/4/134486674/basozuzukepelasu.pdfIn PDF document text
    • https://remenogabeta.weebly.com/uploads/1/3/4/0/134012297/f56fe8d189.pdfIn PDF document text
    • https://www.lipca.com/ckfinder/userfiles/files/zukisajirubomosutujorel.pdfIn PDF document text
    • https://besixovit.weebly.com/uploads/1/3/5/9/135997460/pogenamowip.pdfIn PDF document text
    • http://www.sgpm.krakow.pl/aanewsysn/kcfinder/upload/files/87039373795.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000528be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x528BE 10676 bytes
SHA-256: 9beade6b42d2be940edab04e710aa6d80eeaf6fde5ff345106f23a9623a8dd85
font_01_sfnt_off00054130.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x54130 17224 bytes
SHA-256: 273e3797e78a160880b6195d492d5064d31b7c386a4ba3c0f715e5a9cdb3e5fb
font_02_sfnt_off00056d56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56D56 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.