Malicious PDF — malware analysis report

Static analysis result for SHA-256 94134f3fb6381215…

MALICIOUS

PDF

356.8 KB Created: 2022-04-24 19:25:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-12
MD5: 742696681f68b03a7aa55517bb355b9d SHA-1: 56768c10927141780be22764e0751d24f224f564 SHA-256: 94134f3fb63812159d41951e33f0e8eff57738b44d9e2138450a051058451368
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and ML classifiers, indicating a high likelihood of malicious intent. The presence of an SEO redirector link associated with a 'bain capital private equity report' lure suggests a phishing or malware distribution campaign. Although no scripts were explicitly extracted, the PDF structure and embedded URLs point towards a malicious document designed to deceive users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7397

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://mifuj.co.za/XSRYdR1H?utm_term=bain+capital+private+equity+report PDF link annotation
    • https://nodimawajovuri.weebly.com/uploads/1/3/4/4/134431691/nukamefanurezad-nedavagubeze-rolexowanidiga.pdfIn PDF document text
    • https://rotterdampools.com/contents/files/sovugabugew.pdfIn PDF document text
    • https://www.drukwerkmax.nl/public/admin/assets/global/plugins/kcfinder/upload/files/mowifobu.pdfIn PDF document text
    • https://jin-ji.com/upload/files/fuvepukufefagegetavu.pdfIn PDF document text
    • https://zoxobafibo.weebly.com/uploads/1/3/4/2/134235835/vopizegobujozam-bovotigepijudi-vujijukojoda.pdfIn PDF document text
    • http://www.velkoobchod-man.eu/ckfinder/userfiles/files/42065114444.pdfIn PDF document text
    • http://zhongjiukeji.com/upload_fck/file/2022-2-2/20220202144617322819.pdfIn PDF document text
    • http://veszpremkosar.hu/_user/file/552453472.pdfIn PDF document text
    • https://sportcity.bg/webroot/img/content/files/88204032892.pdfIn PDF document text
    • https://murerodotabuvo.weebly.com/uploads/1/3/5/3/135327115/8463782.pdfIn PDF document text
    • https://pomulopegodetom.weebly.com/uploads/1/3/1/3/131384256/nipakipukikaju.pdfIn PDF document text
    • http://sinching.com/uploadpic/files/202204032106029548.pdfIn PDF document text
    • https://kiwemedorupa.weebly.com/uploads/1/3/4/4/134446537/gukevejatepiw_pekalozozudo_moxanuvubi.pdfIn PDF document text
    • https://vubedupimobu.weebly.com/uploads/1/3/5/3/135314939/digewoxidovad_fapuvotaj.pdfIn PDF document text
    • https://doctmcooper.com/userfiles/files/buxuwojorimawif.pdfIn PDF document text
    • https://xaweregosakub.weebly.com/uploads/1/3/1/4/131407668/898a9eb83.pdfIn PDF document text
    • https://terojejiw.weebly.com/uploads/1/3/5/3/135348369/6051930.pdfIn PDF document text
    • https://nekamijej.weebly.com/uploads/1/3/4/6/134633096/widuvogo_nozidofilamot.pdfIn PDF document text
    • http://www.plavanikojencupraha.cz/upload/files/tetakikomerasuwafug.pdfIn PDF document text
    • http://tesorosdelayer.net/imgs/images/files/85519510991.pdfIn PDF document text
    • https://vajibudutoneraz.weebly.com/uploads/1/3/4/3/134345344/wuxakulana_jowipa_rapebuzom_tozisom.pdfIn PDF document text
    • https://javevopikaze.weebly.com/uploads/1/3/4/4/134489205/segiliri_dapitinupata_gupikiju.pdfIn PDF document text
    • http://marymo.ru/uploads/files/95143694030.pdfIn PDF document text
    • http://bep-au-cong-nghiep.theonejsc.com/userfiles/file/35480706016.pdfIn PDF document text
    • https://tramincojp.com/uploads/news_file/nafijade.pdfIn PDF document text
    • https://zisafidavilux.weebly.com/uploads/1/3/2/8/132814196/lezewakawivigapariv.pdfIn PDF document text
    • http://gmpardis.dga.gr/ILC/img/file/69516124668.pdfIn PDF document text
    • https://donapubiniwid.weebly.com/uploads/1/3/4/3/134321809/kujisijapopoditakinu.pdfIn PDF document text
    • https://jutisopi.weebly.com/uploads/1/3/4/7/134775863/0df1944475ea43.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005268a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5268A 17320 bytes
SHA-256: 041a7c3ac64e3bd84d52faee9b64c8406e502b7c92d0c78649744b63987f0444
font_01_sfnt_off000553a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x553A5 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00056bbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56BBC 10676 bytes
SHA-256: e6d8792e4d38ce01ae25b5590be466ec2ba5bf7f8b6da54818973cbc4f68c74a

Open this report in the interactive analyzer, or submit your own file for analysis.