Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5d2e2b34722434e…

MALICIOUS

PDF

559.6 KB Created: 2022-03-18 21:45:30 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-28
MD5: 5bf07a16aa542cd5b32f972e553c24c3 SHA-1: fde0605ad30e827c379ff1bd61acf3fc2bfd1d49 SHA-256: c5d2e2b34722434e0a65e5473e553570599e4a4c1a0963938e2aece751b9062b
144 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5708

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yoyep.co.za/XSRYdR1H?utm_term=cast+screen+apk+crack PDF link annotation
    • https://angkaganjil.com/contents/files/jebazufoxuzen.pdfIn PDF document text
    • http://www.colegiometa.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/162218f601df55---78589003754.pdfIn PDF document text
    • http://vietnam-intraco.com/webroot/img/files/suxakenavo.pdfIn PDF document text
    • http://smartsecurity24.pl/userfiles/file/lufebo.pdfIn PDF document text
    • https://rockyhotelsgroup.com/uploaded/files/sonozugewivigosi.pdfIn PDF document text
    • https://grandecentrepointhotels.com/upload/file/sawavuzako.pdfIn PDF document text
    • http://akwarella.pl/user_uploads/file/kojif.pdfIn PDF document text
    • http://location-a-la-reunion.com/js/kcfinder/upload/files/80025451216.pdfIn PDF document text
    • https://www.taxiserviceh24.com/wp-content/plugins/formcraft/file-upload/server/content/files/16227eff758c6a---biribawopiwizumipobixi.pdfIn PDF document text
    • http://changzhou.chinatupai.com/web/js/ckfinder/userfiles/files/tedujolobutadogevosemolos.pdfIn PDF document text
    • http://ambulatorioveterinariocamali.com/userfiles/files/tivinujovewofokajo.pdfIn PDF document text
    • https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622f12dff1229---59665897275.pdfIn PDF document text
    • http://esteel.my/userfiles/file/zosumotipiziwaj.pdfIn PDF document text
    • http://ore-processing.ru/d/files/nefuvisanofawosofe.pdfIn PDF document text
    • https://cvconstructionsgoa.com/pharma/admin/userfiles/file/29641552253.pdfIn PDF document text
    • http://saraco.kz/public/uploads/files/58616595581.pdfIn PDF document text
    • http://jatechkj.pl/upload/fck/file/28275608561.pdfIn PDF document text
    • http://elmasryeverline.net/public/kcfinder/upload/files/82460137356.pdfIn PDF document text
    • https://staging.smartmoneymatch.com/ckeditor/kcfinder/upload/files/gujanapoxuwod.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00084d56.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84D56 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_01_sfnt_off00086471.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86471 19828 bytes
SHA-256: c6566eabf431c8870f1919940104fcc248608508487058c896777352d066722b
font_02_sfnt_off00089855.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x89855 10232 bytes
SHA-256: d028d5c8617f7d83d855b88c86cb82049603397b81c848ac4a0f39fb883280d1

Open this report in the interactive analyzer, or submit your own file for analysis.