Malicious PDF — malware analysis report

Static analysis result for SHA-256 793d4d70805586e1…

MALICIOUS

PDF

74.8 KB Created: 2021-03-30 09:07:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-15
MD5: a422a7ecebb763cfa23ed4999bedae7e SHA-1: 272cf2138779184931947db8a0119f60efc8235f SHA-256: 793d4d70805586e1d786d493137002a1001499d93d1257dbfdd83c3df5af1982
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kefudepoduwudi.sportsontheweb.net/tifenirinitavasekije.pdf In PDF document text
    • https://tapogizixe.weebly.com/uploads/1/3/4/8/134897788/63f5df0c6336.pdfIn PDF document text
    • http://loduwij.scienceontheweb.net/23297002158.pdfIn PDF document text
    • http://kazexezawulozij.mypressonline.com/68508903520.pdfIn PDF document text
    • https://wijinopupog.weebly.com/uploads/1/3/5/3/135323990/gowegenowurilu-pimoli-zowigoniroxure-tubakotuxusetav.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4505687/normal_5fd0d8746e226.pdfIn PDF document text
    • https://fopojikanerev.weebly.com/uploads/1/3/4/8/134888820/mepodofatubuzinijewi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4475987/normal_605005e514314.pdfIn PDF document text
    • https://tatosemivuzufik.weebly.com/uploads/1/3/4/5/134599987/3071164.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://feedproxy.google.com/~r/wb/ENAH/~3/Xr6F2PkPTcg/wb?keyword=digital%20marketing%20course%20free%20udemyPDF link annotation
    • https://s3.amazonaws.com/midipes/lesobikomamazawajilawemo.pdfIn PDF document text
    • https://c36efdde-2309-4ce2-a10d-b6df2ce12cd8.filesusr.com/ugd/e98059_2d77b17fbfa24e5c9868d2ad00e996b1.pdf?index=trueIn PDF document text
    • https://f608bf75-187c-4b28-9621-af925c05c2b6.filesusr.com/ugd/05e3ad_495f2b3d543e49eb8d632048ffcd441a.pdf?index=trueIn PDF document text
    • http://bamonoxo.onlinewebshop.net/88841104630.pdfIn PDF document text
    • https://s3.amazonaws.com/tawosutosuxi/offer_of_employment_letter_uk_template.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a5b05bc-51cf-4e07-bd61-402c40983045/92953059218.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ca68afd-9f80-4fcd-abf9-31d5f1b0403b/argumentative_writing_examples_for_middle_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cff32d66-ac89-4ed3-acec-527d0bfbc282/ivy_league_schools_with_free_online_courses.pdfIn PDF document text
    • https://b615eccc-4413-4b1d-8109-ede925130a83.filesusr.com/ugd/0994f9_c0f200a728944dbbb77cba06bc604934.pdf?index=trueIn PDF document text
    • http://dirulibas.onlinewebshop.net/89560922011.pdfIn PDF document text
    • https://s3.amazonaws.com/zupenafud/53206507004.pdfIn PDF document text
    • https://14864a69-2465-45da-a912-c6f78a3f99b9.filesusr.com/ugd/409ca8_2841e096ce6f422b822febc3a9fa5732.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xedewofuretujo/10026028148.pdfIn PDF document text
    • https://7e8267f5-6380-480e-ad72-df526eaefc07.filesusr.com/ugd/cbe325_8b4555b7d9614fc28845134269387faa.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/44a3fa49-8e21-43be-803a-14aa0dee5403/nec_national_electrical_code.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e749.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE749 5504 bytes
SHA-256: 256ea719be344fb2f386a1f5e818b646ea3706f0b1ecb6070ebfc87595f00799
font_01_sfnt_off0000fa00.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFA00 10428 bytes
SHA-256: 1a4223d7ef080b0770612f81f28358cee41e07f07cd4082bae96fa3601c06252

Open this report in the interactive analyzer, or submit your own file for analysis.