Malicious PDF — malware analysis report

Static analysis result for SHA-256 9413fb92954c46cc…

MALICIOUS

PDF

282.5 KB Created: 2022-01-06 17:29:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-12
MD5: e18c1fafeb933c7e9bd27c72d04c208d SHA-1: d636792c5d0adcdb9707a563dfa1ce0bc033a743 SHA-256: 9413fb92954c46ccd2b6dea83c8d3b68593cd9859301254040cade5a5d0478bb
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7234

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://minlinart.com/archive/upload/files/44139982710.pdf In PDF document text
    • http://nelly-design.ru/upload/files/81682910589.pdfIn PDF document text
    • http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/jiji3tl5795lhkskrm9qf0mo32/suvebogetas.pdfIn PDF document text
    • https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/vgn4k4qll0olnsn597tfts9fj7/84278342204.pdfIn PDF document text
    • http://vhshf.de/File/xaravo.pdfIn PDF document text
    • http://songpinhao.com/userfiles/files/lekoranesopovefupolo.pdfIn PDF document text
    • https://pchome.uzai.ca/upload/files/mazizagalegalami.pdfIn PDF document text
    • http://xmzhj.com/UserFiles/file/11666258549.pdfIn PDF document text
    • http://gt-outillages.fr/ressource/site-image/files/zumuvobiweburum.pdfIn PDF document text
    • http://vencedor.coop/images/admin/file/65865767283.pdfIn PDF document text
    • http://vinhthuan.com/upload/files/97925005393.pdfIn PDF document text
    • http://nanobubblevietnam.com/uploads/userfiles/file/bebawopisokabafojomevine.pdfIn PDF document text
    • https://elpollopaulino.com/cenavarra_userfiles/files/67277588857.pdfIn PDF document text
    • http://hitecds.com/userfiles/file/fakipugitiwabebikak.pdfIn PDF document text
    • http://kondicionery-vidnoe.ru/upload_picture/file/zuragewodukiruwiduti.pdfIn PDF document text
    • http://daiichihr.com/uploads/news_file/87720839553.pdfIn PDF document text
    • http://munnarteabungalows.com/userfiles/file/6653467015.pdfIn PDF document text
    • http://druckmaschinenservice.com/uploads/fce/files/lagofabenod.pdfIn PDF document text
    • https://maturana.cl/upload/file/lutiv.pdfIn PDF document text
    • https://bfull.ru/uploads/files/79236594626.pdfIn PDF document text
    • http://zoncmswebsitebeheer.nl/files/editor/file/91808934125.pdfIn PDF document text
    • https://drnanemilk.com/tctt/sites/aaa/file/kewivaniwekunitunojipojoz.pdfIn PDF document text
    • https://k-barrierfree.com/FileData/ckfinder/files/20211018_A6D088EA01BABD48.pdfIn PDF document text
    • https://feedproxy.google.com/~r/Gsjc/~3/tgwjJlsMqHc/uplcv?utm_term=ati+active+learning+template+medication+blankPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003ffbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FFBC 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336
font_01_sfnt_off0004165b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4165B 16720 bytes
SHA-256: 89f1ba889bf8de73c214e9a5845a29fca5ace2543f95d3edcea896402981ccee
font_02_sfnt_off00044161.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44161 10968 bytes
SHA-256: 9138e3d2c16f4c2b5fbb83fb27d28d27d098f4616c9023e6e700c72355f874a6

Open this report in the interactive analyzer, or submit your own file for analysis.