PDF malware analysis — malicious · af2dcdaa53458f91

MALICIOUS

PDF

408.3 KB Created: 2022-03-12 20:56:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-21

MD5: dc1918f9cfffb2e159a93ec7bd194376 SHA-1: 0930a2211bb588a425383f36a8df328343f385e9 SHA-256: af2dcdaa53458f9174cf536b41162e60c3f2bb5759335e50bc695ed057a1de58

144 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.7751

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://tevav.co.za/XSRYdR1H?utm_term=whatsapp+emoji+meaning+list+pdf PDF link annotation
- http://kamkmori.cz/ckfinder/userfiles/files/wesawaxevojavogosewo.pdfIn PDF document text
- http://cttinteriery.cz/files/upload/files/lefofarun.pdfIn PDF document text
- http://t-eamplus.de/web/editor/files/famadedukibazeriz.pdfIn PDF document text
- https://cserepakciok.hu/xdata/file/85071775650.pdfIn PDF document text
- https://10fci.info/userfiles/file/butopefan.pdfIn PDF document text
- http://bnblspecialities.com/userfiles/files/zelelu.pdfIn PDF document text
- http://missteenqueenuk.com/userfiles/file/muketenonetarowofesulure.pdfIn PDF document text
- http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/1622168a230461---73875046706.pdfIn PDF document text
- http://eepr.cz/upload/files/26241437513.pdfIn PDF document text
- https://bibonatura.hu/ckfinder/userfiles/files/92943189208.pdfIn PDF document text
- http://moje-stranky.eu/userfiles/file/gokubiguteximora.pdfIn PDF document text
- http://energy-partner.pl/kcfinder/upload/files/41715642237.pdfIn PDF document text
- https://sinditamaraty.org.br/site/public/ckeditor/kcfinder/upload/files/raratixazekukabubeveb.pdfIn PDF document text
- http://www.barbantie.com.br/admin/plugins/ckeditor/kcfinder/upload/files/weboxoloxesovogova.pdfIn PDF document text
- http://starcity-vinhomes.vn/app/webroot/img/files/70357397394.pdfIn PDF document text
- https://entabe.com/upload/20220211/files/mafosadutofo.pdfIn PDF document text
- https://viessmannboilers.ca/fck_upload/file/88442614947.pdfIn PDF document text
- https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621fe0288da91---jukajukobenofeda.pdfIn PDF document text
- https://keluargamimpi2.com/contents/files/13109928050.pdfIn PDF document text
- http://konemara.hu/userfiles/file/3222123453.pdfIn PDF document text
- http://bioaec.com/userfiles/files/9378732147.pdfIn PDF document text
- http://waheedullahauto.ae/admin/kcfinder/upload/files/residasofovotimovunul.pdfIn PDF document text
- https://www.lipca.com/ckfinder/userfiles/files/51580267053.pdfIn PDF document text
- https://aawyx.com/sites/default/imageuser/file/wejulejobetuvofo.pdfIn PDF document text
- http://vbond.hk/editor_upload/file/36071845857.pdfIn PDF document text
- https://hobbyschuurtje-webwinkel.be/images/userfiles/file/65455433620.pdfIn PDF document text
- https://www.escolamacrobiotica.pt/backoffice/assets/js/kcfinder/upload/files/74178483127.pdfIn PDF document text
- http://jts-electrical.co.uk/ckfinder/userfiles/files/ranejexulititaxemapenu.pdfIn PDF document text
- https://hkbca.org/UploadFiles/file/20220217144355126.pdfIn PDF document text
- https://www.macfer.com.pt/kcfinder/upload/files/97043888434.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0005e7c5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E7C5	22348 bytes
SHA-256: `89d0ac2bcc0b3bea6f99555be4991b90edea5a26c4f9d3f8be8e18f1748a7800`
`font_01_sfnt_off00062234.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62234	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off00063954.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x63954	10968 bytes
SHA-256: `6f82850e0ccaf26bdd495452c6561a89b87a9d21986243f1f6724674395d5fc5`

Open this report in the interactive analyzer, or submit your own file for analysis.