Malicious PDF — malware analysis report

Static analysis result for SHA-256 941a37457cc9c7ef…

MALICIOUS

PDF

424.5 KB Created: 2022-01-01 18:59:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-12
MD5: 9b36c7bf959ac569f12541a1704c4f38 SHA-1: 432b1479b46e4becd07cda739799cf3aea5e0197 SHA-256: 941a37457cc9c7efe66f10355c0f6d0d5184b4d94e9d01b88e4d37dbe2a357d0
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5156

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://philabc.ru/uplcv?utm_term=home+building+expenses+spreadsheet PDF link annotation
    • http://modelseafarm.com/kweb/ckfinder/userfiles/files/bozogusuwike.pdfIn PDF document text
    • https://pnp-studio.com/fckeditorfiles/file/94885275059.pdfIn PDF document text
    • http://rfinshaat.az/userfiles/file/bebaxaropezemake.pdfIn PDF document text
    • http://locum-system.pl/userfiles/file/2494720083.pdfIn PDF document text
    • https://andhimazhai.com/images/files/wizuj.pdfIn PDF document text
    • http://joesservicecenternj.com/userfiles/files/35741181219.pdfIn PDF document text
    • http://www.icareonline.net.au/ckfinder/icare/files/11471320577.pdfIn PDF document text
    • https://doan295doson.vn/namthuan/images/news/files/47865321119.pdfIn PDF document text
    • http://www.enfersalus.com/ckfinder/userfiles/files/jonexupezalusik.pdfIn PDF document text
    • https://dildendilecevirievi.com/upload/ckfinder/files/vopovomiwefavurim.pdfIn PDF document text
    • https://jdrum-music.com/uploads/ckfiles/files/fukuwibof.pdfIn PDF document text
    • http://xn--d1achljw0b.xn--p1ai/content/upload/35802761974.pdfIn PDF document text
    • http://woori-tour.kr/FileData/ckfinder/files/20211022_CFC591D4F3622A32.pdfIn PDF document text
    • https://escaletravel.com/userfiles/files/tedojap.pdfIn PDF document text
    • http://intechsol.kz/wp-content/plugins/formcraft/file-upload/server/content/files/16167be1b0f8d5---77545470378.pdfIn PDF document text
    • https://perfecthospitals.org/FCKeditor/file/36636998776.pdfIn PDF document text
    • https://ap-qatar.com/userfiles/files/26783331618.pdfIn PDF document text
    • https://allcreaturesinc.com/files/files/14304259623.pdfIn PDF document text
    • http://kssi.ir/public/userfiles/file/vizug.pdfIn PDF document text
    • http://apsara.ru/userfiles/file/34752168691.pdfIn PDF document text
    • http://ip-kamery.cz/files/file/xakivekubi.pdfIn PDF document text
    • http://maaramachandifpo.com/admin/userfiles/file/85969158380.pdfIn PDF document text
    • http://asdgolfclubtoscana.com/writable/public/userfiles/file/zetilipijupibijefafejubo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00063910.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63910 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336
font_01_sfnt_off00064fb4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64FB4 11172 bytes
SHA-256: 2c069a89a75f43f50e754088b61f09ae48f2ff17343900349a4503fa24fa01c3
font_02_sfnt_off00066917.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66917 16480 bytes
SHA-256: 169760550d8abbb5789d9063ee199a93725ef26f4c01694c58970e3d4733a28a

Open this report in the interactive analyzer, or submit your own file for analysis.