PDF malware analysis — malicious · 793e970915532d9b

MALICIOUS

PDF

261.2 KB Created: 2022-02-07 07:33:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15

MD5: b4792620fc7589025659166eb37055d6 SHA-1: c2f3c9b8b0b24cfdc5f843da6c3b0df6466c6f77 SHA-256: 793e970915532d9b347a367ddb4d8cce7cc469300bbcbac818e95affbd9e492f

144 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.6946

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mifuj.co.za/XSRYdR1H?utm_term=android+app+splash+screen+animation PDF link annotation
- http://siamintertrade.com/file_media/file_image/file/pisorinofabos.pdfIn PDF document text
- http://fernandopelosini.it/userfiles/files/bulesibunu.pdfIn PDF document text
- https://digireg.com/upload/vikekudesipa.pdfIn PDF document text
- https://nitdgp.ac.in/uploads/userfiles/files/69178899979.pdfIn PDF document text
- http://eurosolar.cz/res/file/49694152832.pdfIn PDF document text
- https://starfoil-mail.nl/uploads/wysiwyg/naxizofezaseritaf.pdfIn PDF document text
- http://mail.teleserviciomalaga.com/ckfinder/userfiles/files/55458141354.pdfIn PDF document text
- https://imahima.xyz/js/ckfinder/userfiles/files/10479905136.pdfIn PDF document text
- https://tecnicamistasnc.it/file/kodelogo.pdfIn PDF document text
- http://crosswaysrecruitment.com/userfiles/file/sapuvovivovilowep.pdfIn PDF document text
- https://www.prieur-equipement.com/ckfinder/userfiles/files/xanenusilokebezuperu.pdfIn PDF document text
- https://nistd.in/userfiles/file/65877044779.pdfIn PDF document text
- https://phr4u.com/files/gazemiwes.pdfIn PDF document text
- http://zwickerfoto.hu/_user/file/zeniz.pdfIn PDF document text
- https://nanyangtextile.com/userfiles/file/45291614486.pdfIn PDF document text
- http://aftp.bg/userfiles/file/87867014432.pdfIn PDF document text
- http://eqletstalk.com/uploads/files/202201231312165637.pdfIn PDF document text
- http://tunecharts.com/userfiles/file/nojumadamobi.pdfIn PDF document text
- http://solarwindependence.com/ckfinder/userfiles/files/lidunelodeberadawafo.pdfIn PDF document text
- https://dakotaterritorydevelopment.com/ckfinder/userfiles/files/19690809639.pdfIn PDF document text
- https://vg42.ru/public/templates/kcfinder/upload/files/xukikufugegafebawi.pdfIn PDF document text
- http://glassick.com/userfiles/file/82374583092.pdfIn PDF document text
- http://hamyarsanatco.com/ckfinder/userfiles/files/73656001774.pdfIn PDF document text
- https://trungtammaychieu.com/ad-min/js/libs/kcfinder/upload/files/kezopebej.pdfIn PDF document text
- https://cantarefides.ro/admin/userfiles/file/47119591265.pdfIn PDF document text
- http://vocal.bpv.su/content/files/files/91701940658.pdfIn PDF document text
- http://vizit-k.net/uploads/editor/files/kexugipofupemonalagodu.pdfIn PDF document text
- http://www.alcera.ca/userfiles/file/nenoreduwunelit.pdfIn PDF document text
- http://stylingstories.nl/kcfinder/upload/files/53308907798.pdfIn PDF document text
- http://fohow77.ru/upload/file/61501795836.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003aa4c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3AA4C	10760 bytes
SHA-256: `262e4b90218c1c8fd5e3bfb809c6512ec656b52e8b3003d727b94a38a13d39d1`
`font_01_sfnt_off0003c2d3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3C2D3	16616 bytes
SHA-256: `cda588cccdf42f264bb14bdf4cf7f16c948b647b37f2f2d0aad013005857d7f2`
`font_02_sfnt_off0003edfa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3EDFA	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`

Open this report in the interactive analyzer, or submit your own file for analysis.