Malicious PDF — malware analysis report

Static analysis result for SHA-256 9412bf1280daaf78…

MALICIOUS

PDF

252.6 KB Created: 2022-04-07 12:32:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-12
MD5: ee65b08ef177fe59344cb25bf8f8e9f8 SHA-1: 3bfed10ee34ca8293ab8e3b585bb80c4ca961da8 SHA-256: 9412bf1280daaf784a1cb7a86b300427fb0a25897d2eae4f37725e6b3066004c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a high-confidence heuristic indicating it is a phishing lure, using an SEO redirector to disguise a download link. The link itself is presented as a free offer for software, a common social engineering tactic. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to lead the user to a malicious download or exploit. The ClamAV detection further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7006

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lazav.co.za/XSRYdR1H?utm_term=acdsee+photo+studio+professional+2019+free PDF link annotation
    • http://agavietnam.com/img/files/56830238582.pdfIn PDF document text
    • https://xojuliwujugiseb.weebly.com/uploads/1/3/4/3/134388488/gotegobitizupe_gasefoxazupuwep.pdfIn PDF document text
    • http://metabolit.ru/files/file/xedajikunivizaduvu.pdfIn PDF document text
    • https://negapisege.weebly.com/uploads/1/3/4/6/134635707/golovu_tafezotigusoduk_vanadomifisibi_vojasixukezulis.pdfIn PDF document text
    • https://raridebaforu.weebly.com/uploads/1/4/1/2/141280626/sasujolizes.pdfIn PDF document text
    • https://rawutakoze.weebly.com/uploads/1/3/4/3/134326806/jibemerojo-fefeg-poteji.pdfIn PDF document text
    • https://rotufufuzefido.weebly.com/uploads/1/3/4/9/134901673/6740819.pdfIn PDF document text
    • http://anexbd.com/assets/ckeditor/kcfinder/upload/files/gegibelo.pdfIn PDF document text
    • https://bodobazanukabub.weebly.com/uploads/1/3/4/8/134889783/mesugulodusidotuvag.pdfIn PDF document text
    • https://loxuvamozevu.weebly.com/uploads/1/3/4/3/134310095/vowesonozatasof_fazezasiri_wivikodok_voxeroxefanak.pdfIn PDF document text
    • https://deserekinubolid.weebly.com/uploads/1/3/4/3/134319780/296926e6.pdfIn PDF document text
    • https://kijujiwovijuk.weebly.com/uploads/1/3/1/4/131453096/14dca4d1b.pdfIn PDF document text
    • https://tokafiwunan.weebly.com/uploads/1/3/4/3/134372509/5790590.pdfIn PDF document text
    • http://icltindia.in/userfiles/file/68707349917.pdfIn PDF document text
    • https://porovepo.weebly.com/uploads/1/3/4/5/134527374/kamirosakujutabug.pdfIn PDF document text
    • https://funovupudejo.weebly.com/uploads/1/3/4/4/134473131/dapovapilezafutu.pdfIn PDF document text
    • https://zefuduxob.weebly.com/uploads/1/3/4/8/134895043/wuvegezukiwuru.pdfIn PDF document text
    • https://mavegisokelu.weebly.com/uploads/1/3/4/1/134131346/247d1c73150b0.pdfIn PDF document text
    • https://fobepomakiroka.weebly.com/uploads/1/3/0/8/130874330/7547752.pdfIn PDF document text
    • https://mesasijodise.weebly.com/uploads/1/3/5/3/135315214/d1dec9e.pdfIn PDF document text
    • https://pefizisiguxuv.weebly.com/uploads/1/3/1/4/131438819/4446857.pdfIn PDF document text
    • https://jakineporop.weebly.com/uploads/1/3/5/3/135302356/kutupisi-bojazed-zoxelavoduxivu-linekimawima.pdfIn PDF document text
    • https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/306526.pdfIn PDF document text
    • https://jurumebaro.weebly.com/uploads/1/3/4/6/134625591/5883174.pdfIn PDF document text
    • https://alhasooncorp.com/Files/files/zarevijometeguxegeroxab.pdfIn PDF document text
    • https://robiduvasolowa.weebly.com/uploads/1/3/4/6/134657162/gelobedafero.pdfIn PDF document text
    • http://salda.se/saldus/kcfinder/upload/files/lojinutakixusozegazav.pdfIn PDF document text
    • https://debaduvevuw.weebly.com/uploads/1/3/4/3/134383420/lavaniporobigibaj.pdfIn PDF document text
    • http://freemansphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621070e12264a---11176584748.pdfIn PDF document text
    • https://wanalepawipetep.weebly.com/uploads/1/3/1/8/131857983/lotalijuv-wizirunigab.pdfIn PDF document text
    • https://zilibadokaji.weebly.com/uploads/1/3/2/6/132680781/pazuzepekiz-xatiroder-peruvoxavuxak.pdfIn PDF document text
    • https://mallarpurnaisuva.org/go/file/digamewosodufere.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000380a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x380A4 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off000398b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x398B6 18164 bytes
SHA-256: 4f9c616824285e07dfa594d3f27b3e2ea94e80e7009d0f9aa94010b6c8acd9c7
font_02_sfnt_off0003c801.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C801 11260 bytes
SHA-256: bc7d93bae46dd37ecc8b0a7be6468829b10a551cf9344c6c6c99b66618e3fd02

Open this report in the interactive analyzer, or submit your own file for analysis.