Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3e9b310ef2d42bc…

MALICIOUS

PDF

72.4 KB Created: 2021-12-11 22:30:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-21
MD5: 58bb0e19d98743ec8cc1dd1bbd7a4425 SHA-1: 314a9ed9b0ed1daf1357fbce48a20b8a9fd572a1 SHA-256: d3e9b310ef2d42bc133556846180c5041e33d1288ec78568b1228332ae0e4e2e
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://feminella.ro/upload/fck/diwoman.pdf In PDF document text
    • http://kdsonline.org/userfiles/file/zorebakibalo.pdfIn PDF document text
    • http://vtracauto.com/wp-content/plugins/formcraft/file-upload/server/content/files/16159700b6a6d9---tesufasadepadoganofasa.pdfIn PDF document text
    • http://kimandyoo.com/userfiles/file/lipulomoz.pdfIn PDF document text
    • http://cablexconsulting.com/Upload/file/47017024464.pdfIn PDF document text
    • https://codefon.hu/js/ckfinder/userfiles/files/25933598519.pdfIn PDF document text
    • http://braciszewska-klimek.pl/fck_files/file/4556430698.pdfIn PDF document text
    • https://www.la-melodie-des-saveurs.fr/ckfinder/userfiles/files/6113217059.pdfIn PDF document text
    • https://ewt.cz/res/file/10445392524.pdfIn PDF document text
    • https://sport-jicin.cz/dokumenty/19903873992.pdfIn PDF document text
    • http://yokosohk.com/files/fckfiles/file/76467887682.pdfIn PDF document text
    • https://retake.dk/ckfinder/userfiles/files/vagod.pdfIn PDF document text
    • https://milosislandrooms.gr/userfiles/file/61290387568.pdfIn PDF document text
    • http://posicert.com/upload_fck/file/2021-10-11/20211011022051600142.pdfIn PDF document text
    • http://plan.msu.ac.th/ckfinder/userfiles/files/21222414663.pdfIn PDF document text
    • http://taikenplan.jp/ckfinder/userfiles/files/pimorapagin.pdfIn PDF document text
    • http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/59c11f3ca83e48de679c7b8cabba23c7/puzozukile.pdfIn PDF document text
    • http://www.frank-diagn.hu/userfiles/files/makeribufolelugamuzawajul.pdfIn PDF document text
    • http://stellar.ru/ckfinder/userfiles/files/vumara.pdfIn PDF document text
    • http://ccswcd.com/userfiles/file/pedamazofojujazaboxa.pdfIn PDF document text
    • https://aildf.in/userfiles/file/90878929087.pdfIn PDF document text
    • https://amityhr.com/userfiles/file/bobugujeziwekulutovipo.pdfIn PDF document text
    • http://feedproxy.google.com/~r/MbOu/~3/RhDyTiV0TgQ/uplcv?utm_term=how+do+you+change+the+battery+in+a+hunter+douglas+remotePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b4fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB4FC 17660 bytes
SHA-256: aebdcc4ba72e9b30db2d4dee9f7ceda59f7b51dcb5da6b4e30a690cd9d7f2873
font_01_sfnt_off0000e2d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2D3 11248 bytes
SHA-256: a10ebb2d1181c327cd473f31cbb786de93bdad4096491c423d5cd06451484fab
font_02_sfnt_off0000fcd1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCD1 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336

Open this report in the interactive analyzer, or submit your own file for analysis.