PDF malware analysis — malicious · 941c99a2a1f91eb1

MALICIOUS

PDF

337.8 KB Created: 2022-03-30 05:06:23 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-12

MD5: df340f838702e6956c4839d739074dc9 SHA-1: 6b777e731c7462d3532f62673cc2b1dbc99662ee SHA-256: 941c99a2a1f91eb173601921e0e4deafa944ba64bc9c1287cc56e5ffe9e1fc1b

144 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains embedded JavaScript and a high-confidence heuristic indicates it's a phishing lure using an SEO redirector. The primary URL identified, https://colod.co.za/XSRYdR1H?utm_term=fan+made+characters, is likely part of a phishing campaign aiming to trick users into downloading malicious content or revealing sensitive information. ClamAV also detected this file as Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0.

Machine Learning

Nyx PDF Classifier malicious score 0.6533

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://colod.co.za/XSRYdR1H?utm_term=fan+made+characters PDF link annotation
- https://pfhotel.gr/ckfinder/userfiles/files/26930098476.pdfIn PDF document text
- http://liderzy.natura2000.pl/imgturysta/files/88835409498.pdfIn PDF document text
- https://rilulozopofebu.weebly.com/uploads/1/3/1/4/131406258/588cb12c2b.pdfIn PDF document text
- http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/161fb8da750b69---26300946473.pdfIn PDF document text
- https://zubosevofugojat.weebly.com/uploads/1/3/4/3/134307347/9121073.pdfIn PDF document text
- https://busudege.weebly.com/uploads/1/3/4/3/134392642/4377339.pdfIn PDF document text
- https://globalathena.com/ckfinder/userfiles/files/winufusikapi.pdfIn PDF document text
- https://rezilatepupegox.weebly.com/uploads/1/3/5/3/135318796/4f7da596.pdfIn PDF document text
- https://u-spot.biz/js/ckfinder/userfiles/files/86964525092.pdfIn PDF document text
- http://mamolenasnc.it/userfiles/files/57602789777.pdfIn PDF document text
- http://sydjpg.com/images/upload/file/20220209_230743_158.pdfIn PDF document text
- https://lirodenagegoket.weebly.com/uploads/1/3/1/4/131437677/tufenotuxa-tixojufunig.pdfIn PDF document text
- https://komodovo.ru/upload_picture/wuxajeximelenonib.pdfIn PDF document text
- http://staceyasp.com/UserFiles/file/welolowefijivor.pdfIn PDF document text
- https://xexajuxeleseg.weebly.com/uploads/1/3/4/5/134592224/kometakolikafox.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16200ea6958756---84459279667.pdfIn PDF document text
- https://fenuwobubejugud.weebly.com/uploads/1/3/1/4/131454420/fodemajakike.pdfIn PDF document text
- http://www.perchegouet.com/ckfinder/userfiles/files/92660099928.pdfIn PDF document text
- https://mujiborabasovu.weebly.com/uploads/1/3/4/5/134590634/64ab94a.pdfIn PDF document text
- https://gawozigojuvapa.weebly.com/uploads/1/3/4/8/134896601/dudexebejubokol_lodut.pdfIn PDF document text
- https://dutagoloz.weebly.com/uploads/1/3/0/8/130814416/203f1d082.pdfIn PDF document text
- http://caopump.com/admin/userfiles/file/majegiben.pdfIn PDF document text
- https://sopunarexij.weebly.com/uploads/1/3/1/8/131857112/gidurasapegijudotu.pdfIn PDF document text
- https://vafobuzegigotot.weebly.com/uploads/1/3/0/7/130775214/3144869.pdfIn PDF document text
- https://jjcfurnituremaker.com/userfiles/files/subumanipe.pdfIn PDF document text
- http://vnpt247.com/ckeditor/kcfinder/upload/files/65171656165.pdfIn PDF document text
- https://vezefujofebiv.weebly.com/uploads/1/3/5/3/135304234/ac0e833b0ac8.pdfIn PDF document text
- https://moxisuneg.weebly.com/uploads/1/3/4/6/134657449/pafufaz.pdfIn PDF document text
- https://olympicaccessoriesbd.com/assets/ckeditor/kcfinder/upload/files/zuwejop.pdfIn PDF document text
- https://pnp-studio.com/fckeditorfiles/file/41940505912.pdfIn PDF document text
- https://alarouba.com/ckfinder/userfiles/files/jekusafatajimu.pdfIn PDF document text
- https://bopuxokefira.weebly.com/uploads/1/3/5/3/135300507/fa5d30dd.pdfIn PDF document text
- https://tisizapotiw.weebly.com/uploads/1/3/0/7/130776245/gavevijow.pdfIn PDF document text
- https://jizenifujepuv.weebly.com/uploads/1/3/4/4/134489688/0a074fa267e.pdfIn PDF document text
- http://maxbrio.kr/files/files/92939570570.pdfIn PDF document text
- http://www.matrixaviationfueling.com/assets/ckeditor/kcfinder/upload/files/ruriporil.pdfIn PDF document text
- https://supportsurgical.com.br/assets/kcfinder/upload/files/fodurofufatebomiwavonugox.pdfIn PDF document text
- http://tesorosdelayer.net/imgs/images/files/19471868681.pdfIn PDF document text
- https://dofemavuxowag.weebly.com/uploads/1/3/0/7/130739836/318445.pdfIn PDF document text
- http://ultrarelaxedcbd.com/newerac2c/userfiles/file/zifobilijorabagaw.pdfIn PDF document text
- https://xarefiliji.weebly.com/uploads/1/3/4/7/134735925/2f7caab6470.pdfIn PDF document text
- https://tulijibukabez.weebly.com/uploads/1/3/0/8/130814483/vejujizota-ponopalag-nilenekanunixi-wetalu.pdfIn PDF document text
- https://panegovernance.com/ourprojects/chowki/UserFiles/file/41554250673.pdfIn PDF document text
- https://skostishoes.com/userfiles/file/segajiranomodijenew.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
+3 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0004da88.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4DA88	18044 bytes
SHA-256: `a4da7a13cd097db13d89f634bd2077259920931a8bb4e4cdf8b614aaed357b84`
`font_01_sfnt_off000508c4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x508C4	10352 bytes
SHA-256: `1ac43ba4cc1e13483539f93578633d2a03d35b3ad6f927dc864bc2cfba82fc2c`
`font_02_sfnt_off00051fe0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x51FE0	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`

Open this report in the interactive analyzer, or submit your own file for analysis.