Malicious PDF — malware analysis report

Static analysis result for SHA-256 b24cb62c2b658f93…

MALICIOUS

PDF

85.0 KB Created: 2022-05-11 12:34:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-08
MD5: 3e0f49a1da9db39bc621a077c6a14e78 SHA-1: 800a7b29f0669415a53967697363f7e8beaaa0fa SHA-256: b24cb62c2b658f93823455708a97c3f407fbaa9dae0b1e9f3274c573ce150d5f
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9861

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://colod.co.za/XSRYdR1H?utm_term=crane+operator+test+questions+and+answers+pdf+online+test+online+practice PDF link annotation
    • https://tewawabuse.weebly.com/uploads/1/3/1/4/131437503/lawogulojirinan.pdfIn PDF document text
    • https://sanofawuvi.weebly.com/uploads/1/3/4/5/134588151/runomukibewose.pdfIn PDF document text
    • https://vinezizonevo.weebly.com/uploads/1/3/4/3/134320549/0aa4946333a12.pdfIn PDF document text
    • https://www.ppmcare.co.uk/wp-content/plugins/super-forms/uploads/php/files/lbiaqo9tc5selj7862biqrbrqp/34553495491.pdfIn PDF document text
    • https://rumunalitivera.weebly.com/uploads/1/3/4/0/134041361/tobepamexamemaze.pdfIn PDF document text
    • https://vulewerogoxo.weebly.com/uploads/1/3/4/5/134507491/xabifufimafes-xunitetajofur-werokotidamevav-lavazujixa.pdfIn PDF document text
    • https://radigaligoled.weebly.com/uploads/1/3/4/3/134333621/f23451f8f4b75a6.pdfIn PDF document text
    • http://blueleaves.ru/userfiles/file/51353162895.pdfIn PDF document text
    • https://dudezixibuwido.weebly.com/uploads/1/3/4/5/134529197/4016158.pdfIn PDF document text
    • http://congseng.com/uploadfile/files/87819912941.pdfIn PDF document text
    • http://yuanjen.com/ckfinder/userfiles/files/viwefugetu.pdfIn PDF document text
    • http://www.thaiboat.net/image/upload/File/lalogaletasejuwameborut.pdfIn PDF document text
    • https://jiwejezagaxu.weebly.com/uploads/1/3/5/3/135325467/72221824e.pdfIn PDF document text
    • https://zalomumizulewad.weebly.com/uploads/1/3/4/7/134721246/1e40eff1ab44.pdfIn PDF document text
    • https://falukanujenujo.weebly.com/uploads/1/3/2/8/132815213/1710332.pdfIn PDF document text
    • https://luwupedo.weebly.com/uploads/1/3/1/3/131383743/derudusazi-ruwejafozagegex.pdfIn PDF document text
    • https://jidobatixinel.weebly.com/uploads/1/3/4/7/134726111/butugu.pdfIn PDF document text
    • http://yossy.biz/userfiles/file/60627573872.pdfIn PDF document text
    • https://sozaruterir.weebly.com/uploads/1/3/0/7/130738534/1076526.pdfIn PDF document text
    • https://zetovesejideze.weebly.com/uploads/1/3/1/4/131482946/34d2d68d12dcf58.pdfIn PDF document text
    • https://keberalu.weebly.com/uploads/1/3/4/7/134725283/5837830.pdfIn PDF document text
    • https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/564edd8a02eed954efb2fe4fbe197a9b/64968736166.pdfIn PDF document text
    • http://school15-tyumen.ru/f/80365965965.pdfIn PDF document text
    • https://liloxowilobo.weebly.com/uploads/1/3/4/2/134265539/f7320.pdfIn PDF document text
    • https://tozarelap.weebly.com/uploads/1/3/4/4/134497896/2704930.pdfIn PDF document text
    • https://pekarizurimu.weebly.com/uploads/1/4/1/4/141496500/5235673.pdfIn PDF document text
    • https://nowipulegetubut.weebly.com/uploads/1/3/4/6/134647137/5b918.pdfIn PDF document text
    • https://vodutedisevixiw.weebly.com/uploads/1/4/1/6/141610719/6abfaac.pdfIn PDF document text
    • https://dijibuxanizaxi.weebly.com/uploads/1/3/4/8/134859775/bebarefesaxoxugamun.pdfIn PDF document text
    • http://asia-test.informacittadino.net/media/files/vapisi.pdfIn PDF document text
    • https://lijujizakivim.weebly.com/uploads/1/3/4/6/134634855/sobefafuv.pdfIn PDF document text
    • https://jedirixaz.weebly.com/uploads/1/3/4/8/134875163/rejiv_gonajowera.pdfIn PDF document text
    • https://terurudib.weebly.com/uploads/1/3/4/3/134381327/3518764.pdfIn PDF document text
    • https://zinejijosodaxef.weebly.com/uploads/1/4/1/3/141344095/sawebaxavelibazidos.pdfIn PDF document text
    • https://zuxaminuxux.weebly.com/uploads/1/3/4/6/134652083/1801115.pdfIn PDF document text
    • https://www.saenger-ohg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1620bb9a51e003---miketiwumetenugenanewum.pdfIn PDF document text
    • https://lilikisewusufod.weebly.com/uploads/1/3/2/6/132682662/vumiju.pdfIn PDF document text
    • http://inlikeflintlogistics.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621940a8371e6---7220911609.pdfIn PDF document text
    • https://demujerifusa.weebly.com/uploads/1/3/1/4/131437649/9379370.pdfIn PDF document text
    • https://xenexaguvu.weebly.com/uploads/1/3/4/2/134265948/situzadujovekasaraji.pdfIn PDF document text
    • https://draw.pt/home/drawpt/images-editor/file/80983687952.pdfIn PDF document text
    • https://pasuzilab.weebly.com/uploads/1/4/1/4/141466936/takasaxutibega.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    +1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e510.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE510 17336 bytes
SHA-256: 72d7f4984e42c88260a261f4eea7a92361b3b34add6d7cda6073d5610ccd9df4
font_01_sfnt_off000112b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x112B2 10976 bytes
SHA-256: 81f56f4c7510d4384a76fc1f3e783dbf129ba151fe9d8069c5dfd4acf6dae887
font_02_sfnt_off00012c24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C24 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.