PDF malware analysis — malicious · 94104a169f5ca9bc

MALICIOUS

PDF

325.7 KB Created: 2023-10-17 04:04:27 +03:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 5.15.10) First seen: 2026-06-12

MD5: 94dfd979d13bad90f2b2b102afc7354c SHA-1: 38ac60fdc9047627b7586eb286cc1c1955571368 SHA-256: 94104a169f5ca9bc40b253c40dd5c2f5238aad33e9164194a6576eba69cea3f9

176 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a high-severity heuristic firing for a random URL link and an SEO redirector, indicating a phishing or malware lure. The embedded URL points to a suspicious domain, likely intended to download a second-stage payload or redirect to a phishing site. ClamAV also detected this file as Pdf.Phishing.Trojan.

Machine Learning

Nyx PDF Classifier malicious score 0.7618

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vamezoza.fecuq.co.za/772471448065024920?bajenetadusepetasotokezivutojenizibifajinuj=tebovoputaxukoleviwidaboravopapazemegusojuvavemagekudukuliwubosogeleropotajexuvoxavuvusejunanevukawimibotafumadotigoxegexuwitavajibafumitegabunezekopiranosodubepaxekafofutudurotenusopilekamegozovuminepuwo&utm_term=immortal+life+of+henrietta+lacks+summary&bokiwerowuratufugujejoribuzimisokosasanelinifamusubepiwo=juvazufikudatudizozuxodepalavokenoxobufuveziwamilemedilabunolifosebexadazejedepalagejutupojejobipiwozowabaxomajatur In PDF document text
- https://vamezoza.fecuq.co.za/772471448065024920?bajenetadusepetasotokezivutojenizibifajinuj=tebovoputaxukoleviwidaboravopapazemegusojuvavemagekudukuliwubosogeleropotajexuvoxavuvusejunanevukawimibotafumadotigoxegexuwitavajibafumitegabunezekopiranosodubepaxekafofutudurotenusopilekamegozovuminepuwo&utmPDF link annotation
- https://vamezoza.fecuq.co.za/772471448065024920?bajenetadusepetasotokezivutojenizibifajinuj=tebovoputaxukoleviwidaboravopapazemegusojuvavemagekudukuliwubosogeleropotajexuvoxavuvusejunanevukawimibotafumadotigoxegexuwitavajibafumitegabunezekopiranosodubepaxekafofutudurotenusopilekamegozovuminepuwo&utm_term=immortal+life+of+henrietta+lacks+summary&bokiwerowuratufugujejoribuzimisokosasanelinifamusubepiwo=juvazufikudatudizozuxodepalavokenoxobufuveziwamilemedilabunolifosebexadazejedepalagejutupojejobiPDF link annotation
- https://irp-cdn.multiscreensite.com/d6d3400e/files/uploaded/kugisubiled.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/ebd5bd05-06e1-4484-9ce2-3e7628595265/downloads/kipogugegukezudejuwetusu.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/2cd8ef37-3f02-4d83-b132-5400b0b21173/downloads/division_with_remainder_worksheet_for_class_4.pdfIn PDF document text
- https://irp-cdn.multiscreensite.com/6aa2668f/files/uploaded/51541771983-fb0e8418.pdfIn PDF document text
- https://5.imimg.com/data5/SELLER/Doc/2023/10/352963177/CT/WW/RA/200305593/24956215231.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/4d4d12eb-d14e-411e-8b9e-ea7ab3da0557/downloads/68780519392.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/4d4d12eb-d14e-411e-8b9e-ea7ab3da0557/downloads/limite_alcool_portugal.pdfIn PDF document text
- https://img1.wsimg.com/blobby/go/04500130-b4ba-4bc0-a661-5f421359aed4/downloads/fegepadajas.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0004c651.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4C651	15836 bytes
SHA-256: `aaefa8c4cfa70de09bf02e6675e87e9b8439a4a7ed6a3b33627ffb323f4bdeeb`
`font_01_sfnt_off0004ef26.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4EF26	10848 bytes
SHA-256: `f4b42f2e9efe25aed2b5ffa1741866e38427ec9440fa77dbef2d900a2011151b`

Open this report in the interactive analyzer, or submit your own file for analysis.