Malicious PDF — malware analysis report

Static analysis result for SHA-256 793a9ad9ad4646a8…

MALICIOUS

PDF

418.4 KB Created: 2022-04-15 01:10:14 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-14
MD5: a05d12a7b106b2c24485206d7834f445 SHA-1: a34daebadb3a90f5f4b5c750b0dac4c6bae6ddd8 SHA-256: 793a9ad9ad4646a8ac7e854805c6f33f164fe43e53db49e9885b64d7dcccf4e9
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4959

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fecuq.co.za/XSRYdR1H?utm_term=shuttle+badminton+score+sheet+pdf PDF link annotation
    • http://lightofislamonair.org/uploads/files/49883407773.pdfIn PDF document text
    • https://ric-sb.si/uploads/files/pexirivakedukitegivono.pdfIn PDF document text
    • http://parbatsamajjapan.com/img/files/files/48565248529.pdfIn PDF document text
    • http://shinhwacar.com/userData/board/file/35353275508.pdfIn PDF document text
    • https://marikakozmetika.hu/editor_up/66119861186.pdfIn PDF document text
    • http://forsheda.se/admin/kcfinder/upload/files/21009904388.pdfIn PDF document text
    • https://golofoven.weebly.com/uploads/1/4/1/3/141362167/0b008.pdfIn PDF document text
    • http://minhphucvietnam.com/uploads/userfiles/file/lozopeberotalekeba.pdfIn PDF document text
    • http://puebloexec.com/userfiles/file/31947371467.pdfIn PDF document text
    • https://pekatube.weebly.com/uploads/1/3/5/3/135393066/7267175.pdfIn PDF document text
    • http://biopole-clermont.com/uploads/gestion_contenu/files/63565619876.pdfIn PDF document text
    • http://klhl.com/userfiles/file/guwelobufoxusijivunapebes.pdfIn PDF document text
    • https://dallaslandscapedesign.com/media/files/xonumadasozikazolon.pdfIn PDF document text
    • https://levivododusot.weebly.com/uploads/1/3/4/3/134307397/fegakosaxam_sarasud_suwidotuwudisa.pdfIn PDF document text
    • https://gigodetexopisi.weebly.com/uploads/1/3/4/6/134630538/8249863.pdfIn PDF document text
    • https://szemere-iskola.hu/images/files/65844822580.pdfIn PDF document text
    • http://amt-alarmy.pl/userfiles/file/57196678808.pdfIn PDF document text
    • https://mujunoba.weebly.com/uploads/1/3/2/6/132682006/4e4139dc27f6b1.pdfIn PDF document text
    • https://sajapomef.weebly.com/uploads/1/3/4/4/134402225/1e97a3f5e64.pdfIn PDF document text
    • https://lafikekil.weebly.com/uploads/1/3/4/3/134316660/3257897.pdfIn PDF document text
    • http://servetgumrukleme.com/kcfinder/upload/files/39392312039.pdfIn PDF document text
    • https://zutafemaz.weebly.com/uploads/1/3/4/4/134478566/8454449.pdfIn PDF document text
    • https://tisileja.weebly.com/uploads/1/4/1/4/141412799/da446e7238964.pdfIn PDF document text
    • https://wazivako.weebly.com/uploads/1/3/0/9/130969042/5330100.pdfIn PDF document text
    • http://pinboulevard.com/file_space/files/85131661464.pdfIn PDF document text
    • http://massiimo.com/piceditor/file/tapupomukigad.pdfIn PDF document text
    • http://sweed-trans.eu/ckfinder/userfiles/files/jewaxibudoranef.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00061a41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x61A41 17876 bytes
SHA-256: f68a9c7b23476e1bc762d72d8debeeab92c190e7663b387a068e889845c323b2
font_01_sfnt_off0006486e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6486E 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00066085.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66085 11200 bytes
SHA-256: 1dfce49d3390a2abcfec76955aaefa56ab8154037419f6db4fde3258dfe742d0

Open this report in the interactive analyzer, or submit your own file for analysis.