Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbe70946fecdc1e5…

MALICIOUS

PDF

76.9 KB Created: 2022-05-01 13:43:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-23
MD5: d1b700ca847e3e1ee8f845ad129c69e0 SHA-1: 00bfc2cf1704417153e9314861a9c22fa24d5207 SHA-256: cbe70946fecdc1e5aed7040bca9c949d0770c5cf880904fed68ffc7b410a9e13
126 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://podar.co.za/YmrXLWy8?keyword=halo%20bassinest%20swivel%20sleeper%20weight%20limit PDF link annotation
    • http://tsradviseurs.nl/mailing/images/photo/file/gabagorolowebosil.pdfIn PDF document text
    • http://yljczl.com/uploadfile/20220306082757430.pdfIn PDF document text
    • https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1625574d9ca3f9---72205885641.pdfIn PDF document text
    • https://csam-villepinte.org/uploads/images/file/vevet.pdfIn PDF document text
    • http://vipacademy.org/userfiles/file/40098888951.pdfIn PDF document text
    • http://phoiinnhiet.com/images/uploads/files/wemozevi.pdfIn PDF document text
    • https://mubelumovetofap.weebly.com/uploads/1/3/1/8/131856402/xuvebanewefifefi.pdfIn PDF document text
    • http://101-games.ru/images/uploads/files/95309042492.pdfIn PDF document text
    • https://www.truckersplantparts.co.uk/ckfinder/userfiles/files/degikajowusegeriwulevasa.pdfIn PDF document text
    • http://uasolar.com/images/file/roful.pdfIn PDF document text
    • https://kobamewimituk.weebly.com/uploads/1/3/1/6/131606733/zujepugebuwe.pdfIn PDF document text
    • http://brmxn.com/userfiles/file/20220301164847_sklgim.pdfIn PDF document text
    • https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622900ac89b50---vifiw.pdfIn PDF document text
    • http://marketingnews.fr/images/file/rovilusabedebef.pdfIn PDF document text
    • https://siganeloxajur.weebly.com/uploads/1/4/1/3/141302474/5077510.pdfIn PDF document text
    • https://dgssu.com/upfolder/e/files/20220419033348.pdfIn PDF document text
    • http://trailerdepot.ca/site-uploads/vomivotefatasoj.pdfIn PDF document text
    • https://royaloaktravels.com/UserFiles/file/52156598842.pdfIn PDF document text
    • https://reflections-series.gilmorgenstern.com/userfiles/File/nakexosugosizurojuwik.pdfIn PDF document text
    • https://aharonoff.easystockhosting.com/sites/default/files/fckimages/file/37211776417.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0000c6b9.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0000c6b9.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c6b9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC6B9 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000ded0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDED0 10980 bytes
SHA-256: c4a5ba2f55bb7d480efaf83f30da5c9e9b6657c330078019fa996f5c90a11516
font_02_sfnt_off0000f7e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF7E3 17700 bytes
SHA-256: 9df109a1c91fb6eb903914908083703d67ca4b8cf6534532f260f59e02cdf36a

Open this report in the interactive analyzer, or submit your own file for analysis.