Malicious PDF — malware analysis report

Static analysis result for SHA-256 9415aef949b7baa7…

MALICIOUS

PDF

79.4 KB Created: 2022-04-12 15:51:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-12
MD5: f9956574a0e33afd6bd32f8ef61cd63c SHA-1: 7327dc97b7a44d183ce4883b5bdcd2d5db6edc40 SHA-256: 9415aef949b7baa7e0c9c8b041c571255b40d15c9492e03d6eb64f3fae03e2fa
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://podar.co.za/YmrXLWy8?keyword=matematica%20financiera%20ejercicios%20interes%20compuesto PDF link annotation
    • http://spasinnia.org/assets/ckeditor/kcfinder/upload/files/nujur.pdfIn PDF document text
    • https://wickedcheesy.com/images/file/33921149248.pdfIn PDF document text
    • http://rztria.ru/kcfinder/upload/files/lupatujewojinatigad.pdfIn PDF document text
    • http://fazendasaojudastadeu.net/fotosempresa/files/25558265044.pdfIn PDF document text
    • https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161fbc1f210d36---wamokenuxedet.pdfIn PDF document text
    • https://thenovgorodspaceship.andreirozen.com/images/files/28979119122.pdfIn PDF document text
    • https://shotclock.ca/wp-content/plugins/super-forms/uploads/php/files/520f85cff2bdbd3afb97256f04c93863/11710485445.pdfIn PDF document text
    • https://springkasteelhuren.be/userfiles/file/jovexuwuvibovililabarom.pdfIn PDF document text
    • http://www.podunajsko.sk/app/webroot/ckeditor/kcfinder/upload/files/56373687647.pdfIn PDF document text
    • http://seeweb.ciscoxmlservices.com/img/temp/file/81807785584.pdfIn PDF document text
    • http://yeke.com.tr/public/kcfinder/upload/files/11233090225.pdfIn PDF document text
    • http://www.css-jp.com/upfile/files/2022/04/11/meveseforevatasudupo.pdfIn PDF document text
    • http://everestsherpatravel.com/demo/public/ckeditor/kcfinder/upload/files/letabeluferetuvuzobexuxu.pdfIn PDF document text
    • https://carcarnet.com/home/sandbox/domains/hkdance.tritek.hk/public_html/ckfinder/userfiles/files/42260338839.pdfIn PDF document text
    • http://archiwum.wyryki.eu/admin/ckfinder/userfiles/files/menininuwazekisikemu.pdfIn PDF document text
    • https://webeboxux.weebly.com/uploads/1/3/4/4/134493090/nekuwosijute_fepina_jowexikidixut_fidixi.pdfIn PDF document text
    • https://svltv.in/userfiles/files/vuzemo.pdfIn PDF document text
    • http://turnwealthy.com/ckfinder/userfiles/files/jixuxukibafodidibisipato.pdfIn PDF document text
    • https://vimavopama.weebly.com/uploads/1/3/4/7/134769365/5cc1a5bcb17c6.pdfIn PDF document text
    • http://xycrusher.com/d/files/dirafifewad.pdfIn PDF document text
    • http://coolscape.info/images/files/taxogubijezesifonupolunus.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cbed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCBED 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000e3ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE3FF 18356 bytes
SHA-256: 0d3a82f68482bc542485e1ecd6f2f4bcd149e36e5e408bda90bdae6067272419
font_02_sfnt_off00011388.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11388 10816 bytes
SHA-256: 954ab0329a10c636a5fa494752c82b4dfc0315b55b9a8ac508ef864e10c9e8f4

Open this report in the interactive analyzer, or submit your own file for analysis.