Malicious PDF — malware analysis report

Static analysis result for SHA-256 782ab2cb4ef9bb1d…

MALICIOUS

PDF

73.4 KB Created: 2022-05-10 15:04:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-16
MD5: b4f9d0a7334c5b9a524cd4de4f862e21 SHA-1: 1ebabc89cab1309d02cc8f97618e85a82fc0f292 SHA-256: 782ab2cb4ef9bb1da212510cce3860b8921806ad6bf8d1ab29796f17fee396be
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9840

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mifuj.co.za/YmrXLWy8?keyword=common%20irregular%20verb%20list%20pdf%20online%20download PDF link annotation
    • https://keratikada.weebly.com/uploads/1/4/1/2/141280061/b653e627f2be6f.pdfIn PDF document text
    • https://sedixiru.weebly.com/uploads/1/3/0/7/130740143/c906530.pdfIn PDF document text
    • https://hanakspotrebice.cz/eshop/ckfinder/userfiles/files/45698957886.pdfIn PDF document text
    • http://rediger.vammenkro.dk/upload/files/47559409344.pdfIn PDF document text
    • http://commandhousecreations.com/uploads/files/66240512540.pdfIn PDF document text
    • https://zeloruzo.weebly.com/uploads/1/3/5/3/135349371/bisunezuruwixufe.pdfIn PDF document text
    • http://fatfailogistics.com/fckeditor/files/file/katimaniwu.pdfIn PDF document text
    • http://lngpetro.com/userfiles/file/20071069392.pdfIn PDF document text
    • https://em.heephong.org/ethnicminorities/cmsadmin/ckfinder/files/godoranubomobodoj.pdfIn PDF document text
    • http://dabaizhongxue.com/upload_fck/file/2022-3-14/20220314033712159386.pdfIn PDF document text
    • http://marcobernini.it/userfiles/files/jetomozufaxufilufol.pdfIn PDF document text
    • https://kuhni-italy.ru/media-temp/img/uploads/files/33130099598.pdfIn PDF document text
    • https://lotteppta.com/beta/assets/file/nudiwavaxapetenavakin.pdfIn PDF document text
    • https://sanaguxa.weebly.com/uploads/1/4/1/7/141719520/c8cbd260fb.pdfIn PDF document text
    • http://rulada.by/upload/editor/files/zuxunirifuforututerunegut.pdfIn PDF document text
    • https://ginegumogigoxi.weebly.com/uploads/1/3/2/8/132816185/revoramoge-tetexiro-lakun-popizumini.pdfIn PDF document text
    • https://unimal.ac.id/assets/plugin/kcfinder/upload/files/pikovanafavikubakowatuv.pdfIn PDF document text
    • http://act4urplanet.eu/webroot/upload/files/xadojow.pdfIn PDF document text
    • http://moutierrozeille.fr/userfiles/file/72299914896.pdfIn PDF document text
    • https://nugatifijomit.weebly.com/uploads/1/3/4/7/134715362/karano-wozegajufi-jurivet.pdfIn PDF document text
    • https://marapuje.weebly.com/uploads/1/4/1/5/141549080/a180a.pdfIn PDF document text
    • https://tifogufa.weebly.com/uploads/1/3/1/6/131637606/jaduxibe.pdfIn PDF document text
    • https://penopamez.weebly.com/uploads/1/3/4/4/134496097/kikivanutas.pdfIn PDF document text
    • http://semidesigns.eu/app/webroot/userupload/files/16560781071.pdfIn PDF document text
    • https://xevuradapo.weebly.com/uploads/1/3/3/9/133986258/xoxalabowikuv_xijatan_vozeno.pdfIn PDF document text
    • https://entabe.jp/upload/20220318/files/gibime.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b9a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB9A6 16660 bytes
SHA-256: 99384f84c0ac3ac9088852d1f5d2ba3d6d34ce487442ccea52bb8bc79a0192c8
font_01_sfnt_off0000e554.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE554 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0000fd6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD6B 11264 bytes
SHA-256: 3bd4bac70edf6fcf820f3c8a89ade8036031e4d91003c2ea0a2b5ce1334583e4

Open this report in the interactive analyzer, or submit your own file for analysis.