Malicious PDF — malware analysis report

Static analysis result for SHA-256 793e5db4b9c19c5d…

MALICIOUS

PDF

399.1 KB Created: 2022-01-31 08:16:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15
MD5: 92cfb3335ed8ce9e5c20462c35bfac41 SHA-1: 77af173738812ce7f9fae4cce53787bfe4325475 SHA-256: 793e5db4b9c19c5d539660164f32ca5af274d1b5347e8bcb7974fd395694d6e4
144 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6563

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://sunuf.co.za/XSRYdR1H?utm_term=electronic+structure+of+atoms+worksheet PDF link annotation
    • https://ip-kamera-rendszer.hu/ckfinder/userfiles/files/61442597592.pdfIn PDF document text
    • https://monarchwinemerchants.com/wp-content/plugins/super-forms/uploads/php/files/4b4976dcd69352b78e510a656e458629/medegelakividatev.pdfIn PDF document text
    • http://p-energo.ru/content/file/67513792960.pdfIn PDF document text
    • http://futsalcb.cz/picture/vtextu/file/samumapakapukuma.pdfIn PDF document text
    • http://svsteinfurth.de/radsportfiles/file/97862600735.pdfIn PDF document text
    • https://ngusacdon.com/upload/files/58988596151.pdfIn PDF document text
    • http://angel-conference.org/upload_fck/file/2021-11-14/20211114004850154997.pdfIn PDF document text
    • http://ucg-eg.com/userfiles/file/19452030229.pdfIn PDF document text
    • http://ipcmanpower.com/admin/style/images/userfiles/file/53546235887.pdfIn PDF document text
    • http://ilpiccantino.it/admin/data/img/uploads/files/pejotagikuno.pdfIn PDF document text
    • http://ipost.mn/ckfinder/userfiles/files/14002857606.pdfIn PDF document text
    • http://forensique.ch/app/webroot/kcfinder/upload/files/kurane.pdfIn PDF document text
    • http://yusungchart.com/userData/board/file/65947567448.pdfIn PDF document text
    • https://ozora.schaffsen.com/contents/file/xuduke.pdfIn PDF document text
    • https://mosaicopeoplecorporation.com/ckfinder/userfiles/files/vufiwovujexepudajokobewuw.pdfIn PDF document text
    • http://gesht.ru/admin/ckfinder/userfiles/files/xetatag.pdfIn PDF document text
    • http://cadex-forensic.com/app/webroot/kcfinder/upload/files/romedobipo.pdfIn PDF document text
    • http://antonellascarpittadesigner.it/userfiles/files/tofufimejapodateguvoxadir.pdfIn PDF document text
    • http://ansing.nl/userfiles/file/86517741599.pdfIn PDF document text
    • http://www.focitabor.hu/userfiles/file/14211162449.pdfIn PDF document text
    • http://seamacros.com/upload/file/nenefokeginile.pdfIn PDF document text
    • http://www.ez4parcel.net/upfile/files/2021/09/11/4815509840.pdfIn PDF document text
    • https://panasonicenergy.sk/editors/ckeditor/plugins/kcfinder/upload/files/pevuratemibenuterot.pdfIn PDF document text
    • https://www.opsclown.it/ckfinder/userfiles/files/10873597483.pdfIn PDF document text
    • https://www.worldpco.org/includes/js/ckeditor/kcfinder/upload/files/dadigazumezupogu.pdfIn PDF document text
    • https://rainwater.cc/images/uploads/files/26071776776.pdfIn PDF document text
    • https://tempatpasang.com/contents/files/26266987110.pdfIn PDF document text
    • http://neurooperations.com/ckfinder/userfiles/files/kerumeg.pdfIn PDF document text
    • https://alubiasdetolosa.com/files/galeria/files/44566885920.pdfIn PDF document text
    • https://istanajpdua.com/contents/files/74529448067.pdfIn PDF document text
    • http://saikunghouse.hk/userfiles/26425812228.pdfIn PDF document text
    • http://ambulatorioveterinarioilghirlandaio.it/userfiles/files/jiwutigawovuvepukixiwi.pdfIn PDF document text
    • http://realtor-madrid.com/uploades/fckeditorfile/lunuzunipajenokuwejuretig.pdfIn PDF document text
    • http://www.barbazan-debat.fr/ckfinder/userfiles/files/nidozapobazix.pdfIn PDF document text
    • http://gist.adrianlechowicz.pl/userfiles/file/sesawagatuzirug.pdfIn PDF document text
    • https://landlorddebtadvisory.com/wp-content/plugins/super-forms/uploads/php/files/b0d8f51541ab99261fa082d7adef12bc/68876898646.pdfIn PDF document text
    • http://poliman.srv.br/assets/kcfinder/upload/files/murivebedowigo.pdfIn PDF document text
    • http://wallbedsindia.com/uploads/rujutugepefusepit.pdfIn PDF document text
    • https://gtnet-engine.com/ckfinder/userfiles/files/31023080741.pdfIn PDF document text
    • http://vitalenzyme.com/uploads/fckupload/file/purenize.pdfIn PDF document text
    • https://xtremefitksa.com/ckfinder/userfiles/files/96520859494.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005ceef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5CEEF 10860 bytes
SHA-256: 5e8ffc8fdefb57236842c4e4fc09db6c19c15e8522d80c4755abf673ef7f0631
font_01_sfnt_off0005e7e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E7E7 17396 bytes
SHA-256: 628efa197f19bb4e59ae3f58af5d617d3f4d1dd2e69265f552c10b5a9beecbb9
font_02_sfnt_off0006157c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6157C 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336

Open this report in the interactive analyzer, or submit your own file for analysis.