Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5d294d80b55bc40…

MALICIOUS

PDF

178.0 KB Created: 2022-03-25 19:49:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-28
MD5: afee69d2363306eaad9d9568a9a892f1 SHA-1: b5e9aaf536be3a1331213960af5cf3812f549d7b SHA-256: c5d294d80b55bc4016c6a742c02b7836b5ab4bea2ed2d97a4cdfd10363b2f671
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9648

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/YmrXLWy8?keyword=distributed%20systems%20for%20fun%20and%20profit%20%E7%BF%BB%E8%AF%91 PDF link annotation
    • https://nepujegoxamo.weebly.com/uploads/1/3/4/3/134380276/9258690.pdfIn PDF document text
    • https://sogovowezop.weebly.com/uploads/1/3/4/3/134324678/2760969.pdfIn PDF document text
    • https://fukikabigo.weebly.com/uploads/1/3/4/4/134457586/lomenovanatoj_rotibapik.pdfIn PDF document text
    • https://gipenozup.weebly.com/uploads/1/3/1/0/131070487/vimoxoluwaba.pdfIn PDF document text
    • https://sesumevikenaful.weebly.com/uploads/1/3/5/3/135346106/9559276.pdfIn PDF document text
    • https://sakolepak.weebly.com/uploads/1/3/4/5/134588428/7067863.pdfIn PDF document text
    • https://kesevaze.weebly.com/uploads/1/3/1/3/131383297/f4a1312b.pdfIn PDF document text
    • https://sedeberelaniku.weebly.com/uploads/1/3/6/0/136030724/kolulujixewogon_tomile.pdfIn PDF document text
    • https://mivatuvogap.weebly.com/uploads/1/3/4/0/134040868/zevexafojokifa.pdfIn PDF document text
    • https://jowozutosi.weebly.com/uploads/1/4/1/2/141231593/jowitijut_nolijoras.pdfIn PDF document text
    • https://fuwurukuzubefek.weebly.com/uploads/1/3/0/9/130969433/kivavonazerifodedub.pdfIn PDF document text
    • https://dutajidadu.weebly.com/uploads/1/3/4/7/134730474/f02682071.pdfIn PDF document text
    • https://lugemubijovige.weebly.com/uploads/1/3/4/8/134879604/8959649.pdfIn PDF document text
    • https://rixifumalig.weebly.com/uploads/1/3/1/4/131437092/7445952.pdfIn PDF document text
    • https://duxegebipuvakij.weebly.com/uploads/1/3/4/0/134095857/a99dfd3271.pdfIn PDF document text
    • https://dixawofira.weebly.com/uploads/1/3/5/3/135303501/5dee31d823.pdfIn PDF document text
    • https://zamomojufowa.weebly.com/uploads/1/3/4/6/134613680/1963471.pdfIn PDF document text
    • https://tadonajates.weebly.com/uploads/1/3/4/3/134319020/volububuvuludir.pdfIn PDF document text
    • https://vidulegu.weebly.com/uploads/1/3/4/8/134897898/2220092.pdfIn PDF document text
    • https://makemugajisere.weebly.com/uploads/1/3/5/3/135317455/sinoxudofari-kopop-jamumimizaz-sigosa.pdfIn PDF document text
    • https://guxofavopadowan.weebly.com/uploads/1/3/5/9/135988616/jovasodigas.pdfIn PDF document text
    • https://vesexifog.weebly.com/uploads/1/3/4/4/134491049/082d9a5a5.pdfIn PDF document text
    • https://jebupamix.weebly.com/uploads/1/3/6/0/136098333/3522c68c1.pdfIn PDF document text
    • https://japekubejur.weebly.com/uploads/1/3/0/7/130775222/tofariv_sidelodereb_vipurewoget.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f256.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF256 17544 bytes
SHA-256: 9c8f3ad572f47ab738bd0d2b7f7d878c5263bdd22a7f4fe18d21e0a13b16829f
font_01_sfnt_off00012065.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12065 10968 bytes
SHA-256: c8ec044eaff92a1a26a65fb7ec82e05590eb777c754bfc4c415b4c5f6121a789
font_02_sfnt_off000139b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x139B7 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336
font_03_sfnt_off00015053.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15053 147056 bytes
SHA-256: 31a0a9fdc79933a964c4bc850075d88d4a6fa34c3fe32cab9a61ccf2d9f7aea1

Open this report in the interactive analyzer, or submit your own file for analysis.