PDF malware analysis — malicious · 78232d2564086755

MALICIOUS

PDF

174.1 KB Created: 2022-03-06 10:06:58 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-16

MD5: 01fc47a92b4e789c9bb005765857b2d8 SHA-1: 1e45f9f8d3d8a7512fcccbccc440dbc72e8dfe89 SHA-256: 78232d2564086755184d1d5375092b1a3178c7689d2192c33b911e08488c2b77

134 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.7406

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://loheb.co.za/XSRYdR1H?utm_term=checkbox+android+checked+color PDF link annotation
- http://uveteknik.com/uploads/files/jurabotowekivudav.pdfIn PDF document text
- http://tetobox-budapest.hu/uploads/files/benova.pdfIn PDF document text
- http://avgustal.ru/kcfinder/upload/files/13229655091.pdfIn PDF document text
- http://savaksangida.com/resimler/files/gesuvugiwusimesi.pdfIn PDF document text
- http://www.megasaludips.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620ee7905871b---12013724230.pdfIn PDF document text
- http://tnhmc.com/userfiles/file/36545227265.pdfIn PDF document text
- http://agrostroi-proekt.ru/ckfinder/userfiles/files/wopevusipuxozopaveredusos.pdfIn PDF document text
- https://perfectionistpaintingnj.com/ckfinder/userfiles/files/96499507303.pdfIn PDF document text
- https://sportscientistsviews.ijmsir.com/ckfinder/userfiles/files/97244824621.pdfIn PDF document text
- https://vaitinhdien.com/app/webroot/upload/files/nupisobixasuxubajaji.pdfIn PDF document text
- http://prmakeup.com/Image/files/31115523128.pdfIn PDF document text
- http://jcmb.gris-de-payne.fr/app/webroot/kcfinder/files/logusubekesi.pdfIn PDF document text
- https://hunglivet.com/uploads/files/202203040017215744.pdfIn PDF document text
- http://nebodom.com/userfiles/file/95178488810.pdfIn PDF document text
- http://rendszerguru.hu/admin/kcfinder/upload/files/61572221903.pdfIn PDF document text
- https://abcdev.opusviewdev.com/app/webroot/js/image/files/laxarofuvozojiwoz.pdfIn PDF document text
- http://www.jssmiec.com/themes/js/kcfinder/upload/files/xonegeretak.pdfIn PDF document text
- http://bookblog.kr/data/file/files/sagexulosutuxepo.pdfIn PDF document text
- http://driver-jazda.pl/upload/file/38680565053.pdfIn PDF document text
- https://ric-sb.si/uploads/files/39011712695.pdfIn PDF document text
- https://tmtechvn.com/webroot/img/files/bojinotekejiwakazajelas.pdfIn PDF document text
- https://efckrakow.pl/userfiles/file/49216885833.pdfIn PDF document text
- http://premo.at/userfiles/file/58523695215.pdfIn PDF document text
- http://xn----8sbkebltdkywd.xn--p1ai/ckfinder/userfiles/files/lugobisutatadizajano.pdfIn PDF document text
- https://nguyenvanhuongloc.vn/app/webroot/files/images/pages/files/ruxuzawusojejimura.pdfIn PDF document text
- http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621c6caae5450---zinilokesora.pdfIn PDF document text
- https://zenmobile.in/jaipriyart/uploads/files/dapojuvowusa.pdfIn PDF document text
- http://mevlanaasm.com/resimler/files/97972682030.pdfIn PDF document text
- http://theofficeplus.com/userfiles/file/76737448438.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000251c0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x251C0	10568 bytes
SHA-256: `00a4cab25ea13fa177e86d1c658c27ed15afe2373fa7650420ddc50f448f2125`
`font_01_sfnt_off000269c1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x269C1	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off000280dc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x280DC	15636 bytes
SHA-256: `a5701f559acd514b3642a027b94ca450b639088e49644bcbb8f9c0c7d66e980c`

Open this report in the interactive analyzer, or submit your own file for analysis.