Malicious PDF — malware analysis report

Static analysis result for SHA-256 7931fc7b4bfb21aa…

MALICIOUS

PDF

56.8 KB Created: 2022-06-23 23:59:45 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 5.15.4) First seen: 2026-06-15
MD5: a86783c347352b8d1e27670bc5e10acf SHA-1: ff39c0c70dd1b34df000e91d768f4a55a8e93484 SHA-256: 7931fc7b4bfb21aa2a1215a9979af25a6df9b41c11a2a483c16a4fbafe85604f
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/YmrXLWy8?keyword=bibi%20fatima%20ka%20mojza%20in%20urdu%20pdf%20files%20full PDF link annotation
    • https://lagidipivawe.weebly.com/uploads/1/3/4/3/134347483/6400646.pdfIn PDF document text
    • https://reratedazakowim.weebly.com/uploads/1/3/1/3/131378897/626d3e7281cba.pdfIn PDF document text
    • http://gynekolog-zilina.sk/uploads/fck/file/86286316947.pdfIn PDF document text
    • http://mevlanaasm.com/resimler/files/turikozi.pdfIn PDF document text
    • http://ttv23.ru/public/file/72498485312.pdfIn PDF document text
    • https://zidipezes.weebly.com/uploads/1/3/5/3/135314083/6984114.pdfIn PDF document text
    • https://zewijevatijafat.weebly.com/uploads/1/3/4/2/134265582/5384330.pdfIn PDF document text
    • http://formanwoman.ru/userfiles/files/83131150143.pdfIn PDF document text
    • https://damujulul.weebly.com/uploads/1/3/5/3/135335913/luvivisapexu-babuxajaluk-rezagawafebodo.pdfIn PDF document text
    • https://vetesigajis.weebly.com/uploads/1/4/1/7/141746508/gabewarorosel-matanofimutat-rosemuroxa-pamilolajodi.pdfIn PDF document text
    • http://pay2pay.net/upload/file/59523260830.pdfIn PDF document text
    • http://servetgumrukleme.com/kcfinder/upload/files/timetomofarogusewog.pdfIn PDF document text
    • https://gibejuta.weebly.com/uploads/1/3/0/7/130776113/tolet.pdfIn PDF document text
    • https://zidukatuf.weebly.com/uploads/1/3/0/7/130775563/jebudeponimone.pdfIn PDF document text
    • https://zodaxilijelepev.weebly.com/uploads/1/4/1/9/141930429/9c3c18db41.pdfIn PDF document text
    • https://shining4u.com/wp-content/plugins/super-forms/uploads/php/files/f755f5a9a789bf3383badbc8420152e7/57868213319.pdfIn PDF document text
    • https://numemepo.weebly.com/uploads/1/3/0/9/130969514/5f7b756a.pdfIn PDF document text
    • https://wokogosomexar.weebly.com/uploads/1/3/5/3/135322546/vogutuvigumi.pdfIn PDF document text
    • http://www.bitstream.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B7C 8856 bytes
SHA-256: 44c8af1385b163023526d0c5a4425e44828f10cb29aa1f39a301671e07e3757a
font_01_sfnt_off00007fea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FEA 8940 bytes
SHA-256: 897a1d9f6f4b474150d2504b8fa79d1507a5ac285a7fb2bf61803f06dc51c46c
font_02_sfnt_off00009202.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9202 15856 bytes
SHA-256: 63ccede5a20ff2225a4fc1b9ee89446b0525bf100f8b336d5709c040cc0f4f75
font_03_sfnt_off0000bc2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBC2F 10320 bytes
SHA-256: 6571d4cbdd5b1e428cbc25d1f1c29580702b918d6bd3a3161b2ff4953a2f09c6

Open this report in the interactive analyzer, or submit your own file for analysis.