Malicious PDF — malware analysis report

Static analysis result for SHA-256 800c3b53781668d7…

MALICIOUS

PDF

178.3 KB Created: 2022-06-01 08:20:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-02
MD5: 1af4a456d2795490b2d3c0e10f953723 SHA-1: 361a3e7957702fa7d2c8661cd0011d14969fea70 SHA-256: 800c3b53781668d7fe600ceb74d0b596f80790303a2e5975a1589a594727b829
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9619

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
    Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=used+to+vs+past+simple+exercises+pdf+printable++2017 PDF link annotation
    • https://pedekibitu.weebly.com/uploads/1/3/4/6/134669881/8916688.pdfIn PDF document text
    • https://mehreganimaging.com/images/upload/files/fenov.pdfIn PDF document text
    • https://bulugigedi.weebly.com/uploads/1/3/4/7/134714886/topidigepubuzag-potusagawo.pdfIn PDF document text
    • https://fileduwefevara.weebly.com/uploads/1/3/4/3/134384607/572132.pdfIn PDF document text
    • http://medigroupvn.com/upload/files/40992491211.pdfIn PDF document text
    • https://neverazu.weebly.com/uploads/1/3/4/9/134901342/dovesopizapuzap-tupulupow-raxup.pdfIn PDF document text
    • https://kipufexafubasoj.weebly.com/uploads/1/4/1/4/141425580/kimonadubibewo-bobijoruz-kitovigapuje-mibejonutavapol.pdfIn PDF document text
    • https://giweberemep.weebly.com/uploads/1/3/2/6/132682555/3955270.pdfIn PDF document text
    • https://dagatofolake.weebly.com/uploads/1/3/0/8/130874029/buvunubokov_lexur_roditu.pdfIn PDF document text
    • https://meronikam.weebly.com/uploads/1/3/4/7/134705372/mubopitenisedoz.pdfIn PDF document text
    • http://ahtirka.topmebli.com/content/xuploadimages/file/28820832442.pdfIn PDF document text
    • https://jivetigaforivuj.weebly.com/uploads/1/3/4/3/134350389/b69fcf7b.pdfIn PDF document text
    • http://www.evisiontiendaonline.com/ckfinder/userfiles/files/76528069392.pdfIn PDF document text
    • https://wugaxaxelapuwu.weebly.com/uploads/1/3/4/5/134595152/nefevijepu.pdfIn PDF document text
    • https://sipexagugiresu.weebly.com/uploads/1/3/4/6/134607427/625e20.pdfIn PDF document text
    • https://www.myjamaicais.com/wp-content/plugins/super-forms/uploads/php/files/d3450a5278c2b429f30441601eca2c7b/fulegumoluzawovakasem.pdfIn PDF document text
    • https://gawugabel.weebly.com/uploads/1/3/4/3/134361726/a9d46bc7f13a.pdfIn PDF document text
    • https://lamekibig.weebly.com/uploads/1/3/4/6/134652122/279838.pdfIn PDF document text
    • https://istanajp.net/contents/files/27951872569.pdfIn PDF document text
    • http://ufnk.fr/app/webroot/files/file/kavevo.pdfIn PDF document text
    • https://for-auto.dispaco.ro/userfiles/file/32898225254.pdfIn PDF document text
    • http://jd6618.com/jd6618/file/2022-3/file/LwpCms2022_03_05_13_23_10_6746.pdfIn PDF document text
    • https://lomowurepiv.weebly.com/uploads/1/3/1/4/131437546/vatuvi_nawatelukaxupu_vaxumijevofo.pdfIn PDF document text
    • https://zudejafig.weebly.com/uploads/1/3/2/6/132681624/081d61159a12.pdfIn PDF document text
    • https://nonibebufixaz.weebly.com/uploads/1/3/2/6/132682934/37f2ee9ff9b5bfe.pdfIn PDF document text
    • http://cadex-forensique.ch/app/webroot/kcfinder/upload/files/losadodiwofisabi.pdfIn PDF document text
    • https://zedodunojoponex.weebly.com/uploads/1/3/6/0/136083391/rejap-noraparemanijep-bapuw.pdfIn PDF document text
    • https://lorazitir.weebly.com/uploads/1/3/4/3/134393639/400fe5f6b.pdfIn PDF document text
    • https://gokalobinure.weebly.com/uploads/1/3/4/8/134861303/6465144.pdfIn PDF document text
    • https://doxity.ro/ckfinder/userfiles/files/51961037774.pdfIn PDF document text
    • https://regivuno.weebly.com/uploads/1/3/1/0/131070843/damujedo.pdfIn PDF document text
    • https://bofujajaba.weebly.com/uploads/1/4/1/5/141516826/6860466.pdfIn PDF document text
    • https://xutetuzaxudekit.weebly.com/uploads/1/3/4/3/134371691/wexokewaboxumajigino.pdfIn PDF document text
    • https://ichibaninfotech.com/ckfinder/userfiles/files/17762904904.pdfIn PDF document text
    • http://idroter.org/userfiles/files/dufunizekibakesozodepag.pdfIn PDF document text
    • https://tubuporupuruder.weebly.com/uploads/1/3/4/8/134879971/3378527.pdfIn PDF document text
    • https://pirexabi.weebly.com/uploads/1/3/4/8/134885086/gaberujosunininopod.pdfIn PDF document text
    • https://mapevitesofik.weebly.com/uploads/1/3/1/6/131606073/rizevudonitepexin.pdfIn PDF document text
    • https://wufowidujexo.weebly.com/uploads/1/3/5/2/135293423/9301264.pdfIn PDF document text
    • http://www.shipsupply.co.mz/wp-content/plugins/formcraft/file-upload/server/content/files/162049ae5ace8e---57134312459.pdfIn PDF document text
    • http://ahtirka.topIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0002590a.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0002590a.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002590a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2590A 11440 bytes
SHA-256: d7e62a84a7756368089df653f7d780a626c0f1b3d1a7320aa86104caa9d7ef13
font_01_sfnt_off000273fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x273FA 17400 bytes
SHA-256: c834ca9a4d61de77dbddcd0cfc21e9791ca376e17dad789f55985de81978a78d
font_02_sfnt_off0002a16f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A16F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.