Malicious PDF — malware analysis report

Static analysis result for SHA-256 a4f7f4dd53b4d85a…

MALICIOUS

PDF

93.6 KB Created: 2022-04-16 19:10:13 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-07-02
MD5: a309c6242cf5381a5de42a252f066826 SHA-1: c0070ad982fa468fba79cf388e9341bc1609f64a SHA-256: a4f7f4dd53b4d85ab369ae35706d2c361837a326f4d0cd2d1e4304ad5851f32a
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9826

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://podar.co.za/XSRYdR1H?utm_term=parozone+bleach+spray+safety+data+sheet PDF link annotation
    • https://wezawemexa.weebly.com/uploads/1/3/1/4/131410399/lapenakukamosen.pdfIn PDF document text
    • https://luzijegeze.weebly.com/uploads/1/3/4/0/134040843/1e9a687a.pdfIn PDF document text
    • https://wafulezejo.weebly.com/uploads/1/3/4/7/134748518/vuzukotasi.pdfIn PDF document text
    • http://alfadent-volg.ru/images_uploads/files/11233843193.pdfIn PDF document text
    • https://migivijebejod.weebly.com/uploads/1/3/4/0/134017877/xugag.pdfIn PDF document text
    • https://jonobelo.weebly.com/uploads/1/4/1/2/141282032/bidag-wagenisefozew.pdfIn PDF document text
    • https://buwofapakudo.weebly.com/uploads/1/3/5/3/135316190/vuzodutejaxew.pdfIn PDF document text
    • https://zufugorutamivas.weebly.com/uploads/1/3/4/4/134401118/xexuvobadu-buperonej-wisoxati-vuxogu.pdfIn PDF document text
    • https://sotukotemuk.weebly.com/uploads/1/3/4/0/134042326/79122.pdfIn PDF document text
    • http://casopisfolklor.sk/assets/kcfinder/upload/files/gafirobevajifa.pdfIn PDF document text
    • http://woodwork.pl/ubezpiecz/obrazy/file/semixawi.pdfIn PDF document text
    • https://wezawelo.weebly.com/uploads/1/3/0/8/130813956/8a432e17216a.pdfIn PDF document text
    • https://lulegosepo.weebly.com/uploads/1/3/0/9/130969478/vetage_papukobakene_palurewopaxux.pdfIn PDF document text
    • https://paxolobiwoke.weebly.com/uploads/1/3/1/1/131163878/mutif.pdfIn PDF document text
    • https://zuxovowosug.weebly.com/uploads/1/4/1/2/141295172/jusefefunubewen.pdfIn PDF document text
    • https://tenigirexono.weebly.com/uploads/1/3/4/6/134645883/efc7b35a7a1.pdfIn PDF document text
    • https://gebipobewixaduk.weebly.com/uploads/1/3/4/6/134631326/muwidadura.pdfIn PDF document text
    • https://sokudepan.weebly.com/uploads/1/3/1/8/131871622/1fba0b7727d0858.pdfIn PDF document text
    • http://circolosilverblufitnessclub.eu/userfiles/files/44477835714.pdfIn PDF document text
    • https://musalakom.weebly.com/uploads/1/4/1/2/141254118/5030460.pdfIn PDF document text
    • https://dikekivex.weebly.com/uploads/1/3/0/7/130775400/726c3f725d.pdfIn PDF document text
    • https://zixomozugoruku.weebly.com/uploads/1/4/1/3/141342544/nogukogofusirabiv.pdfIn PDF document text
    • https://kaneloko.weebly.com/uploads/1/3/1/4/131408798/3c2d18.pdfIn PDF document text
    • https://radewisuvux.weebly.com/uploads/1/3/4/6/134689192/xofunadu.pdfIn PDF document text
    • http://energo-market.ru/sadm_files/joguguwajesuxexoxatemowi.pdfIn PDF document text
    • https://scalper.ir/data/files/file/90667294040.pdfIn PDF document text
    • https://nijopuxevaduni.weebly.com/uploads/1/4/1/4/141423588/zatexega.pdfIn PDF document text
    • https://gogekelonirivi.weebly.com/uploads/1/3/4/4/134438841/finezurutadide_bimat_lamuvotenape_taxepobaramowu.pdfIn PDF document text
    • https://ruweladoj.weebly.com/uploads/1/3/7/5/137502803/646aa7d.pdfIn PDF document text
    • https://juladugalevatib.weebly.com/uploads/1/3/4/3/134385664/baxozalug-rerezilomipake-xijuwipa.pdfIn PDF document text
    • https://mafatuxaxi.weebly.com/uploads/1/3/1/3/131384293/c3fc3cae8f.pdfIn PDF document text
    • https://vomifudumapo.weebly.com/uploads/1/3/5/3/135345338/nufexiriroxaseb.pdfIn PDF document text
    • https://jawebufor.weebly.com/uploads/1/3/4/6/134647112/167d3b12efe7dff.pdfIn PDF document text
    • https://liguputuked.weebly.com/uploads/1/3/4/5/134501996/petot.pdfIn PDF document text
    • https://gopapugefuzepu.weebly.com/uploads/1/3/1/4/131438672/novidajusib.pdfIn PDF document text
    • https://kemizanina.weebly.com/uploads/1/3/0/7/130738765/70d676de72.pdfIn PDF document text
    • https://wikojenuvovada.weebly.com/uploads/1/3/4/2/134266286/weridivakolulimav.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00010dfd.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00010dfd.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010dfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10DFD 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off00012614.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12614 10940 bytes
SHA-256: abc5accedc836c0c4282d30640c8fe89b7729d85d53525b6256dd1e61dd0e4b6
font_02_sfnt_off00013f3f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F3F 15688 bytes
SHA-256: 34f9a3f67640bee3f4b5a3111d0611c28ce7a9e776e607abe82d9a677b9e6e28

Open this report in the interactive analyzer, or submit your own file for analysis.