Malicious PDF — malware analysis report

Static analysis result for SHA-256 8449a7a93c779b53…

MALICIOUS

PDF

240.1 KB Created: 2022-06-19 18:08:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-27
MD5: 46b59c905ca03fa8d86bc46cb7c02ec2 SHA-1: a866400ba4bb5d96306be645166ac6c11bf3d9ea SHA-256: 8449a7a93c779b53a09e8dd643a403133c5b532b8032536a0747b7739bf8aa24
76 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9555

Heuristics 4

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mactos.ru/page_edit/_samples/userfiles/files/12435279154.pdf In PDF document text
    • https://kimiragijasem.weebly.com/uploads/1/3/4/0/134096233/banedanopa-pamepumaraf-zibibelol.pdfIn PDF document text
    • https://kojuvabij.weebly.com/uploads/1/4/1/7/141748622/nuwavirejujivovi.pdfIn PDF document text
    • https://funegalarupot.weebly.com/uploads/1/3/4/3/134316730/mirisaxowimu.pdfIn PDF document text
    • https://zimuvudiredefux.weebly.com/uploads/1/3/2/7/132710782/126e0fb6.pdfIn PDF document text
    • https://mamexobupelo.weebly.com/uploads/1/3/1/3/131383482/1753201.pdfIn PDF document text
    • https://wepejusekubikur.weebly.com/uploads/1/3/4/4/134441987/juzedu.pdfIn PDF document text
    • http://konberdbio.com/upload/files/bokovamefeduseneweva.pdfIn PDF document text
    • https://bamujatufex.weebly.com/uploads/1/4/1/5/141560198/woragasivo.pdfIn PDF document text
    • https://dioss.eu/files/ckfiles/file/ruwetanuvefoke.pdfIn PDF document text
    • http://tiszaladany.hu/upload/file/21675269255.pdfIn PDF document text
    • https://sowekunozo.weebly.com/uploads/1/3/5/3/135321923/zulezizas_subeg.pdfIn PDF document text
    • http://prodesign31.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16246cdfe04a84---65365702797.pdfIn PDF document text
    • https://sepetumeba.weebly.com/uploads/1/3/4/6/134601334/202547a8f9e0d.pdfIn PDF document text
    • https://vedakevuvapi.weebly.com/uploads/1/3/4/0/134013486/de7e8484fe74ab6.pdfIn PDF document text
    • https://berovifis.weebly.com/uploads/1/3/4/7/134730871/e0191f.pdfIn PDF document text
    • https://terracell.info/images/file/7987220724.pdfIn PDF document text
    • http://www.awakohchang.com/image/upload/File/isugowikubetagako.pdfIn PDF document text
    • https://sudefebes.weebly.com/uploads/1/4/1/4/141441293/sewujaratajonolan.pdfIn PDF document text
    • https://gobiduromom.weebly.com/uploads/1/3/4/6/134660247/tuputivu.pdfIn PDF document text
    • https://nivozigagu.weebly.com/uploads/1/3/4/4/134439663/rawuperosawanam.pdfIn PDF document text
    • http://wsospice.org/uploads/userfiles/file/file/nubuvepa.pdfIn PDF document text
    • https://mifuj.co.za/XSRYdR1H?utm_term=dual+beam+cathode+ray+oscilloscope+pdf++full+crackPDF link annotation
    • https://sakidadofedoza.weebly.com/uploads/1/3/4/7/134762178/jurunumelis-midelesolupugo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00034f1b.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00034f1b.bin)

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00034f1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34F1B 11228 bytes
SHA-256: 2d1ca09e21963492e4f3a8dd5f85180641d0c6b2564257d63a26dee539ab48b5
font_01_sfnt_off00036939.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x36939 19536 bytes
SHA-256: 6e71d940636cd898bc307093ad405436d86a0579894a7a9ee0c55e83176b1176
font_02_sfnt_off00039bd0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x39BD0 16624 bytes
SHA-256: b9885b858743daf5271366ef60e29c3b31793d730ffa1bfa679e48d1b1ac0cb0

Open this report in the interactive analyzer, or submit your own file for analysis.