Malicious PDF — malware analysis report

Static analysis result for SHA-256 c5d6401810c79b5e…

MALICIOUS

PDF

74.4 KB Created: 2022-03-26 09:38:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-27
MD5: dfc1132ce7cd2f5852c943f8e2ebe193 SHA-1: 5601cf5bfd56def8b77bbdb2449b18ec340a9626 SHA-256: c5d6401810c79b5ef2248bc623274b584fdd6e7db4f5db097d9afaf2d382997e
186 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/YmrXLWy8?keyword=mackie%20cfx20%20mixer%20manual%20en%20espa%C3%B1ol PDF link annotation
    • https://bizugejukuvav.weebly.com/uploads/1/3/4/3/134322279/14626fe.pdfIn PDF document text
    • https://wekijoborumotis.weebly.com/uploads/1/3/4/4/134484899/jibilabolanef_fewuber_zuvusuzidewigik_tafubota.pdfIn PDF document text
    • https://woxevawalonot.weebly.com/uploads/1/3/7/5/137517472/945865.pdfIn PDF document text
    • https://basisini.weebly.com/uploads/1/3/4/7/134775363/pufasedidijexedun.pdfIn PDF document text
    • https://voviteri.weebly.com/uploads/1/3/4/9/134904749/kizebibived-rokif.pdfIn PDF document text
    • https://zebewanuvaxa.weebly.com/uploads/1/3/4/6/134613040/duluvawapap.pdfIn PDF document text
    • https://lenimupet.weebly.com/uploads/1/3/4/0/134013040/4927522.pdfIn PDF document text
    • https://wigowuwadapol.weebly.com/uploads/1/3/5/3/135315864/zajaf-monofo-selumoxamafik-kizagew.pdfIn PDF document text
    • https://davijonixumitu.weebly.com/uploads/1/3/5/3/135349017/mefidaku_xetitizawadarez_kopazipuleranal_xubejis.pdfIn PDF document text
    • https://mudepazenanaj.weebly.com/uploads/1/3/4/7/134765609/1514103.pdfIn PDF document text
    • https://ruwelijowabol.weebly.com/uploads/1/3/4/3/134307429/8182bc70db.pdfIn PDF document text
    • https://zexonozanefamiw.weebly.com/uploads/1/3/1/1/131163740/sobegud-vukokumedo-zetabezirita-tipibipomu.pdfIn PDF document text
    • https://vesemidibokopiz.weebly.com/uploads/1/3/4/8/134869856/walalovakepaza.pdfIn PDF document text
    • https://kafowudozajem.weebly.com/uploads/1/3/4/6/134613952/643710.pdfIn PDF document text
    • https://pefizisiguxuv.weebly.com/uploads/1/3/1/4/131438819/wujajefifuk-vujogili-duzabaxitapajep-rosegufabe.pdfIn PDF document text
    • https://janunawavi.weebly.com/uploads/1/3/4/3/134314220/xozexonotokimo_faboxuke_raruvigulutowid.pdfIn PDF document text
    • https://bolowarokarov.weebly.com/uploads/1/3/4/3/134349384/1d1767.pdfIn PDF document text
    • https://gujejedadun.weebly.com/uploads/1/3/1/3/131398181/2917068.pdfIn PDF document text
    • https://vopozurizezeta.weebly.com/uploads/1/3/4/0/134012331/bekano-mudogefusodud.pdfIn PDF document text
    • https://vusasetimonumak.weebly.com/uploads/1/3/4/8/134855164/panipifova.pdfIn PDF document text
    • https://pokukumujipuk.weebly.com/uploads/1/3/1/8/131856200/dipotepiweloki-mudinep-doruvubipapawe-tifepekeme.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b994.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB994 18300 bytes
SHA-256: f7ed3f01f706ed048a7746ffe4557300d66c55252400e7281de6d95e726a4065
font_01_sfnt_off0000e88c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE88C 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336
font_02_sfnt_off0000ff30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFF30 11276 bytes
SHA-256: 060f7ded26f76fbed2109efaf77d4e790fbf0a7593d62508e08dc3d12af9355f

Open this report in the interactive analyzer, or submit your own file for analysis.