Malicious PDF — malware analysis report

Static analysis result for SHA-256 847d772b8e8cf6ce…

MALICIOUS

PDF

454.3 KB Created: 2022-03-05 08:28:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-05
MD5: 4504a7dfd376e4abde1dce4cfd8d8f76 SHA-1: 88b42f13cd2d532e6f0d98ce184e8fdc065c14cd SHA-256: 847d772b8e8cf6cefa0b8166e224e4b918a7540fd45eb9fec2ab1190b2c6bc3f
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5868

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lazav.co.za/XSRYdR1H?utm_term=makalah+dermatitis+atopik+pdf PDF link annotation
    • https://unicon-msk.ru/data/files/81836083880.pdfIn PDF document text
    • http://robodit.ru/kcfinder/upload/files/60512347763.pdfIn PDF document text
    • https://optimumquestsolutions.com/ckfinder/userfiles/files/sopopuvas.pdfIn PDF document text
    • http://www.louervendreaumaroc.com/kcfinder/upload/files/20120927667.pdfIn PDF document text
    • http://biopole-clermont.com/uploads/gestion_contenu/files/zudun.pdfIn PDF document text
    • https://cokhivietuc.com/img-vietuc/files/ramezewivimef.pdfIn PDF document text
    • http://raiz.jp/kcfinder/upload/files/51659260776.pdfIn PDF document text
    • http://www.biharikft.hu/bihari-admin/ckfinder/userfiles/files/69757355971.pdfIn PDF document text
    • http://vietcem.vn/public/default/ckeditor/files/10976187167.pdfIn PDF document text
    • http://yotlist.com/uniformkontakt/userfiles/image/files/tokisowadawugag.pdfIn PDF document text
    • http://viviapalermo.com/userfiles/files/wizetuweziduneveresijox.pdfIn PDF document text
    • https://cira.thinkabit.net/downloads/files/30303880376.pdfIn PDF document text
    • https://www.giromarilia.com.br/plugins/kcfinder/upload/files/61757638791.pdfIn PDF document text
    • https://topas-septiki.com/media-temp/img/uploads/files/fakilo.pdfIn PDF document text
    • https://www.steyr-mannlicher.hu/admin/kcfinder/upload/files/dexojozerutokivej.pdfIn PDF document text
    • http://swvocal.com/data/se2/file/32674584942.pdfIn PDF document text
    • https://strefaokazji.pl/uploaded/file/vamimim.pdfIn PDF document text
    • http://senseoftourism.dk/userfiles/file/93638526532.pdfIn PDF document text
    • http://www.asbea.org.br/assets/plugins/kcfinder/upload/files/9230403624.pdfIn PDF document text
    • http://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/8e9b87598e34e6643ac277e6be99bb19/53872388080.pdfIn PDF document text
    • http://euro-service.org/kcfinder/upload/images/67803910618.pdfIn PDF document text
    • http://zsdbiopharm.com/upload/files/70398977200.pdfIn PDF document text
    • https://vallejardin.com/wp-content/plugins/super-forms/uploads/php/files/851533bbb1a71b310ef26345108a50a2/2435741820.pdfIn PDF document text
    • http://ttccid.com/userfiles/file/depumetavu.pdfIn PDF document text
    • https://rarahil.org.np/ckfinder/userfiles/files/89627527816.pdfIn PDF document text
    • http://chmer.yun2u.com/upload/files/13717804480.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0006a5b8.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0006a5b8.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006a5b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6A5B8 19780 bytes
SHA-256: d9025857c0359329b233321919b097d7ad54f4036815a472301dddc08ae88e8d
font_01_sfnt_off0006da25.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DA25 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_02_sfnt_off0006f145.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F145 10744 bytes
SHA-256: 6618b86f908df2fa52f5efcba6329afcecd0e994db1b8fa89281da752bc76474

Open this report in the interactive analyzer, or submit your own file for analysis.