Malicious PDF — malware analysis report

Static analysis result for SHA-256 af2e43ec1cdb06d8…

MALICIOUS

PDF

326.5 KB Created: 2022-04-22 21:47:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-21
MD5: b81bedc24fac36993e2189a3e2d1c12f SHA-1: 42a0954a57ef2b9815b98b1a9ebe58c93536daf5 SHA-256: af2e43ec1cdb06d89625be4468870590fb33db675649ff83c19749e4e7658ebe
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6641

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://podar.co.za/XSRYdR1H?utm_term=space+shuttle+launch+video PDF link annotation
    • https://rogebanapixiwo.weebly.com/uploads/1/3/5/3/135343373/wonukubu.pdfIn PDF document text
    • https://gemudafaleg.weebly.com/uploads/1/3/1/8/131856492/pixuzibilexidu_genawuxo_setazowamode_tusuxuvusu.pdfIn PDF document text
    • https://xotogulil.weebly.com/uploads/1/3/4/6/134655180/a857b26.pdfIn PDF document text
    • https://pisusafinado.weebly.com/uploads/1/3/4/3/134363103/dotafarapulo-tokaxuj-jufana-nemotafut.pdfIn PDF document text
    • https://ramaxudefe.weebly.com/uploads/1/3/4/0/134042793/d4715f09.pdfIn PDF document text
    • https://lanulizuxuja.weebly.com/uploads/1/3/4/6/134658029/9318487.pdfIn PDF document text
    • https://xasibegofijuga.weebly.com/uploads/1/3/4/7/134731363/fupika.pdfIn PDF document text
    • https://zegaturivelegob.weebly.com/uploads/1/3/1/4/131437779/0c205.pdfIn PDF document text
    • https://bigubiforuse.weebly.com/uploads/1/3/5/3/135389938/daxanamaja-safemoreguvebuw.pdfIn PDF document text
    • https://sopopubepomexak.weebly.com/uploads/1/3/4/2/134265445/tujikim.pdfIn PDF document text
    • https://gexuganogos.weebly.com/uploads/1/3/0/8/130813630/fevalidetub_ledateju_jetetoxox.pdfIn PDF document text
    • https://nerisowale.weebly.com/uploads/1/3/1/4/131412290/wonabepodafil.pdfIn PDF document text
    • https://risovokoxenixe.weebly.com/uploads/1/3/3/9/133997247/7170339.pdfIn PDF document text
    • https://tozafutesaf.weebly.com/uploads/1/3/4/9/134900259/6088186.pdfIn PDF document text
    • https://migirebunimalab.weebly.com/uploads/1/3/1/3/131383914/fexipaxa_xogufareb.pdfIn PDF document text
    • https://rixagaxovexi.weebly.com/uploads/1/3/4/0/134000332/leziluxebaragibezoso.pdfIn PDF document text
    • https://viwexiwi.weebly.com/uploads/1/3/5/3/135318047/tabazedew.pdfIn PDF document text
    • https://nolupomesu.weebly.com/uploads/1/3/7/5/137510536/8160931.pdfIn PDF document text
    • https://zuwuwenisobos.weebly.com/uploads/1/3/7/5/137500091/99de97a0a1b159.pdfIn PDF document text
    • https://kutusavirub.weebly.com/uploads/1/3/4/2/134265758/zakewutarob_rebolaji.pdfIn PDF document text
    • https://betutinixe.weebly.com/uploads/1/3/4/4/134481053/faxatemedo.pdfIn PDF document text
    • https://fizetisiwukuz.weebly.com/uploads/1/3/4/3/134339589/4631328.pdfIn PDF document text
    • https://zuravenizojexex.weebly.com/uploads/1/3/4/3/134320774/25042095d8ba16.pdfIn PDF document text
    • https://balomufe.weebly.com/uploads/1/3/4/5/134594694/6442134.pdfIn PDF document text
    • https://tagepixibupiz.weebly.com/uploads/1/3/4/5/134586800/4330462.pdfIn PDF document text
    • https://bosesabefo.weebly.com/uploads/1/3/4/3/134362720/nedugomono-melasozizis-xubafileto.pdfIn PDF document text
    • https://miraxijuk.weebly.com/uploads/1/3/7/5/137516829/xuzuzug_vitosakelonuv.pdfIn PDF document text
    • https://kafaxidaduxeb.weebly.com/uploads/1/3/1/4/131438036/7846535.pdfIn PDF document text
    • https://bufogepuvuzi.weebly.com/uploads/1/3/1/3/131381066/4197560.pdfIn PDF document text
    • https://pupaxutakigi.weebly.com/uploads/1/3/4/5/134579126/7047067.pdfIn PDF document text
    • https://dixuxizexejo.weebly.com/uploads/1/3/0/7/130740209/9873484.pdfIn PDF document text
    • https://nulazonale.weebly.com/uploads/1/3/4/8/134892754/wizezatadi.pdfIn PDF document text
    • https://fomimixa.weebly.com/uploads/1/3/4/7/134775862/gixafi.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0004ac46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AC46 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0004c45d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C45D 10752 bytes
SHA-256: 463e5aa78bb8cd40e58acd924d31e750b123978fcc02a6a48c2efded871609d3
font_02_sfnt_off0004dd05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4DD05 18044 bytes
SHA-256: ba56af56541c12cdc88c09b56a76a9cbd8f3d296df5ca6a400668eac33fdf446

Open this report in the interactive analyzer, or submit your own file for analysis.