Malicious PDF — malware analysis report

Static analysis result for SHA-256 793633bb0addd96c…

MALICIOUS

PDF

419.3 KB Created: 2022-01-28 18:33:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15
MD5: c8b79e3a3e8d8ba646fff0e8c512ad4a SHA-1: 2534713e5e0da2985f3ead6208e99d528b413fa6 SHA-256: 793633bb0addd96c6f63a5384e0220972bc2961d13e14a96f73d2138e1315c0c
144 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4362

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mifuj.co.za/XSRYdR1H?utm_term=business+plan+sample+for+food+product+pdf PDF link annotation
    • http://gemaeldeundobjekte.de/uploads/files/57896546880.pdfIn PDF document text
    • http://lavera.it/wp-content/plugins/formcraft/file-upload/server/content/files/161986fb1a93d4---13008812278.pdfIn PDF document text
    • https://rhythmcprandfirstaid.com/wp-content/plugins/super-forms/uploads/php/files/e56023c474b904b24143c34b184cb34b/dogalulisumenofolim.pdfIn PDF document text
    • http://mindentudor.hu/userfiles/file/16110500229.pdfIn PDF document text
    • https://fsbulletsandbrass.com/userfiles/files/57337409988.pdfIn PDF document text
    • http://ghinelliarchitettura.it/userfiles/files/6655298028.pdfIn PDF document text
    • http://solarexperten.ch/fckeditor/editor/images/file/19949957971.pdfIn PDF document text
    • http://1utilaje.ro/mm/file/pupajifomaka.pdfIn PDF document text
    • http://ddservice-bmw.pl/userfiles/file/pewoj.pdfIn PDF document text
    • https://yuktiedu.com/wp-content/plugins/super-forms/uploads/php/files/3bd37aecdb88b21ce98cf745eb42af7c/34129912441.pdfIn PDF document text
    • http://mofald-clpiu.gov.np/public/kcfinder/upload/files/zosibobawekinu.pdfIn PDF document text
    • http://novo-foto.ru/ckfinder/userfiles/files/40708353869.pdfIn PDF document text
    • https://www.alfalahmedical.org/c_panel/ckeditor1/ckeditor/kcfinder/upload/files/72387669939.pdfIn PDF document text
    • http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/cd410b5e63f74522af89230cb8004cd3/limopojitokila.pdfIn PDF document text
    • http://studionegrelli.it/userfiles/files/56366226865.pdfIn PDF document text
    • https://www.paparazzirestaurant.com.au/wp-content/plugins/super-forms/uploads/php/files/5ea4544e8cf617472e1d7002e8382f27/lotenewepiniviwejo.pdfIn PDF document text
    • https://supportsurgical.com.br/assets/kcfinder/upload/files/gabixu.pdfIn PDF document text
    • http://hondatayho.top/img-ngocbao/files/misogivotedudufolozepu.pdfIn PDF document text
    • http://yourhealthyanswer.com/ckfinder/userfiles/files/gujubiv.pdfIn PDF document text
    • http://kaies.net/upfiles/file/gugonumivosavorat.pdfIn PDF document text
    • https://www.alugutader.fr/ckfinder/userfiles/files/57752906866.pdfIn PDF document text
    • http://brcassociati.com/userfiles/files/xawukamexubisiwogo.pdfIn PDF document text
    • http://www.luna1956.com/images/library/File/80590077930.pdfIn PDF document text
    • http://constructionone.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1615619a569c24---jonaburefumutonekepaxo.pdfIn PDF document text
    • http://stadion-zarya.ru/ckfinder/userfiles/files/gowawifuvutamubirejoxuw.pdfIn PDF document text
    • http://northmarking.com/userfiles/files/82974203090.pdfIn PDF document text
    • http://restavratorstvo.com/ckfinder/userfiles/files/66900521184.pdfIn PDF document text
    • http://begues.mobi/userfiles/file/49412251622.pdfIn PDF document text
    • https://sfasg.jp/js/ckfinder/userfiles/files/debosaxotuwepazanidubu.pdfIn PDF document text
    • http://spellenindex.nl/images/uploads/madorigifukejuxup.pdfIn PDF document text
    • http://zekejozsef.eu/FCKfeltoltott/file/ladejovajuvudumidepaj.pdfIn PDF document text
    • http://capitaloffice.pl/fotki/file/begiragotiguvutizud.pdfIn PDF document text
    • http://24hnbc.com/assets/ckfinder/core/connector/php/uploads/files/guboxomiwewowipuxetofimop.pdfIn PDF document text
    • https://sunsoftinfoway.net/ckfinder/userfiles/files/8453866570.pdfIn PDF document text
    • https://www.dazzlingdecor.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16153b7151c69a---24044117346.pdfIn PDF document text
    • http://www.juniorcollege.cl/ckfinder/userfiles/files/26928142112.pdfIn PDF document text
    • http://motocams.cz/ckfinder/userfiles/files/xedavinozezogoxem.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000621f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x621F1 10936 bytes
SHA-256: 04e5a10e106250708a6db19fae3f15132d8fe8c8ea24fb0434bffae2d6e4535b
font_01_sfnt_off00063b43.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63B43 16548 bytes
SHA-256: 0afdd62c774dd7f4583fb11204c7937542b1afd15d6ab25bd374f7a1e631d2d2
font_02_sfnt_off00066623.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66623 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336

Open this report in the interactive analyzer, or submit your own file for analysis.