Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f459bca0f3484c5…

MALICIOUS

PDF

466.6 KB Created: 2022-06-06 19:51:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-06
MD5: dc23e1da5673f48de2fbae60e1639a88 SHA-1: ba4a1748dcdb6b622e120cf37151f6c239a49afb SHA-256: 9f459bca0f3484c53e8b1e7391e16edcfea75934e8494a9500b9f00004756ef8
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4050

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://norin.co.za/XSRYdR1H?utm_term=la+soledad+de+los+numeros+primos+pdf+free+online+free+pdf PDF link annotation
    • https://fixewanum.weebly.com/uploads/1/3/5/3/135309042/pevulawuxagatebiwuj.pdfIn PDF document text
    • http://trendstyleimage.com/uploads/ckfinder/userfiles/files/ludumujeda.pdfIn PDF document text
    • https://hatarozatok.martonvasar.hu/ckeditor/kcfinder/upload/files/64377349249.pdfIn PDF document text
    • https://nafufarub.weebly.com/uploads/1/3/4/2/134266214/bafigeduz.pdfIn PDF document text
    • http://amis-simserhof.fr/kcfinder/upload/files/84666349726.pdfIn PDF document text
    • https://bisajubumiwowi.weebly.com/uploads/1/4/1/5/141515484/tezidasuwowurew.pdfIn PDF document text
    • https://ketokaxuvora.weebly.com/uploads/1/3/1/8/131856042/toxivakakujim.pdfIn PDF document text
    • https://fetoviwenibade.weebly.com/uploads/1/3/4/7/134701039/xubokoguvera-kifix.pdfIn PDF document text
    • https://mikuzowadakan.weebly.com/uploads/1/3/1/3/131383480/xopif.pdfIn PDF document text
    • https://pimelitapata.weebly.com/uploads/1/3/1/4/131454500/3dacb27dcc9.pdfIn PDF document text
    • https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/kolamuxivif_suzuva.pdfIn PDF document text
    • https://gulecbakliyat.com/panel/kcfinder/files/funomibakakumadudunironef.pdfIn PDF document text
    • https://femuketidoxesi.weebly.com/uploads/1/3/3/9/133997502/ropolorojuzitutamek.pdfIn PDF document text
    • http://sksound.com/userfiles/file/43242893548.pdfIn PDF document text
    • https://sinemitivivofa.weebly.com/uploads/1/3/0/7/130740142/domanudopuja_kafewetej_nilafo.pdfIn PDF document text
    • https://tivizaxif.weebly.com/uploads/1/3/1/3/131381605/194420.pdfIn PDF document text
    • https://fexinunob.weebly.com/uploads/1/3/4/4/134432760/578999.pdfIn PDF document text
    • http://ajtoablakcentrum.com/_user/file/81985940087.pdfIn PDF document text
    • https://sapatipiragibo.weebly.com/uploads/1/3/4/7/134708637/lariboxunisebejabuda.pdfIn PDF document text
    • https://ponasamexow.weebly.com/uploads/1/3/1/3/131398296/guxutinogujew.pdfIn PDF document text
    • https://xozavefo.weebly.com/uploads/1/3/4/0/134018900/fafif.pdfIn PDF document text
    • https://royaloaktravels.com/UserFiles/file/3435982727.pdfIn PDF document text
    • https://gozetotafolag.weebly.com/uploads/1/4/1/6/141600476/9021254.pdfIn PDF document text
    • https://nakoregedazov.weebly.com/uploads/1/4/1/4/141465481/66f3a698.pdfIn PDF document text
    • https://situjojug.weebly.com/uploads/1/4/1/3/141304148/vadopigugasiduz_tudorox_xemogoxuwaz_jarimi.pdfIn PDF document text
    • https://puwabasuguwuvez.weebly.com/uploads/1/4/1/3/141355039/jujewenonodemu-xudarax-zuzukasanas.pdfIn PDF document text
    • https://woviwawegar.weebly.com/uploads/1/3/4/3/134319486/zurugofikefididitota.pdfIn PDF document text
    • https://xufolonul.weebly.com/uploads/1/3/2/6/132695880/966339.pdfIn PDF document text
    • https://zusamazoboxo.weebly.com/uploads/1/3/4/5/134527389/15349149810.pdfIn PDF document text
    • https://rozelofesewezu.weebly.com/uploads/1/3/4/0/134040375/futume.pdfIn PDF document text
    • https://sepilibajegaf.weebly.com/uploads/1/3/4/6/134667793/timixisewajolavov.pdfIn PDF document text
    • https://eirai.org/editor/ckfinder/userfiles/files/52701295267.pdfIn PDF document text
    • https://dawifebenunu.weebly.com/uploads/1/3/4/3/134374742/6cbae46fecd3.pdfIn PDF document text
    • https://gefozusep.weebly.com/uploads/1/3/5/3/135346228/jigevalizuziw_dixubafin.pdfIn PDF document text
    • http://artikos.pl/userfiles/file/ximaxurogelizozewenopunu.pdfIn PDF document text
    • http://gidromall.ru/img/uploads/file/depizinibi.pdfIn PDF document text
    • https://www.yukule.com/ToBeDeleted/admin-assets/js/ckeditor_4.6.2_standard/kcfinder/upload/files/povamuvufipejibi.pdfIn PDF document text
    • https://mifevaxa.weebly.com/uploads/1/3/4/3/134360436/gezetilatuz.pdfIn PDF document text
    • https://rosujukasawi.weebly.com/uploads/1/3/5/3/135301647/kalafakigiviv.pdfIn PDF document text
    • https://gawilemo.weebly.com/uploads/1/3/4/0/134012872/jowakipubo_kifivenowu.pdfIn PDF document text
    • https://lufurazorume.weebly.com/uploads/1/3/0/8/130874109/2a9e380dfbf9b.pdfIn PDF document text
    • https://sexaluweve.weebly.com/uploads/1/3/4/8/134854061/d555a.pdfIn PDF document text
    • http://anexbd.com/assets/ckeditor/kcfinder/upload/files/zumobapesosoneparokeliw.pdfIn PDF document text
    • https://dedanolelixavo.weebly.com/uploads/1/3/4/3/134305263/rikixitopakuze.pdfIn PDF document text
    • http://www.cadex.biz/app/webroot/kcfinder/upload/files/fokufukirim.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    +4 more URL(s)

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006d834.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D834 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0006f04b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F04B 10620 bytes
SHA-256: 2de57416a643758e5807c600e72b8aa5b4f7201d31d8f504c325bd6f39ded027
font_02_sfnt_off00070875.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70875 19044 bytes
SHA-256: 3176c7b8551b359250e6f2abcf18f9bf5c67b54c1a941b3f9686de5d70f75573

Open this report in the interactive analyzer, or submit your own file for analysis.