Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7c4ad3c0b92c3c6…

MALICIOUS

PDF

518.4 KB Created: 2022-04-29 21:55:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-22
MD5: f689c48cdd0162659d9a52d62133b3af SHA-1: 399e3a3bf1cbef3d3e0465b07f9ae565e4a6c591 SHA-256: e7c4ad3c0b92c3c6ce562bcbf948166826c1e71431069a9cd232d680f1cae8dc
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3788

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yubit.co.za/XSRYdR1H?utm_term=new+album+songs+malayalam+2018 PDF link annotation
    • https://puzapageduz.weebly.com/uploads/1/3/1/4/131453954/f8c6826ebb2f793.pdfIn PDF document text
    • https://wukugisusip.weebly.com/uploads/1/3/2/6/132695501/xudimubuvonefotuvaja.pdfIn PDF document text
    • https://ranadelogixapik.weebly.com/uploads/1/3/4/4/134483714/4300699.pdfIn PDF document text
    • https://sewarekim.weebly.com/uploads/1/3/4/3/134370683/1c201680d.pdfIn PDF document text
    • https://bamigabimav.weebly.com/uploads/1/3/1/6/131636977/jezupadupesusub.pdfIn PDF document text
    • https://labopepiw.weebly.com/uploads/1/3/4/7/134747507/5814862.pdfIn PDF document text
    • https://dagigofeno.weebly.com/uploads/1/3/4/8/134887245/296aed5e741.pdfIn PDF document text
    • https://bipixivosebik.weebly.com/uploads/1/3/4/5/134516267/nevuvusezijup.pdfIn PDF document text
    • https://ragajepegoxi.weebly.com/uploads/1/3/1/3/131379061/523594.pdfIn PDF document text
    • https://sajijudid.weebly.com/uploads/1/3/5/3/135393685/diloxa.pdfIn PDF document text
    • https://adtw1.com/ckfinder/userfiles/files/muzuteluzezipiv.pdfIn PDF document text
    • https://pesurejipani.weebly.com/uploads/1/3/4/2/134234892/zapetun_xigezufag_folizeboduge.pdfIn PDF document text
    • https://kigodebilak.weebly.com/uploads/1/3/5/2/135297846/b354e8a9.pdfIn PDF document text
    • https://weranatowo.weebly.com/uploads/1/3/1/4/131408071/5335966.pdfIn PDF document text
    • https://dugepawegozil.weebly.com/uploads/1/3/1/6/131606694/bfa193880f.pdfIn PDF document text
    • https://taregegojife.weebly.com/uploads/1/3/3/9/133997559/9524973.pdfIn PDF document text
    • https://lowegigusegok.weebly.com/uploads/1/4/1/5/141537320/7541a56bcd.pdfIn PDF document text
    • http://dichvutot99.com/webroot/img/files/74706869661.pdfIn PDF document text
    • https://kakezilek.weebly.com/uploads/1/3/4/4/134401463/fevired.pdfIn PDF document text
    • https://rakulemiz.weebly.com/uploads/1/3/2/6/132682689/9375486.pdfIn PDF document text
    • https://sufotope.weebly.com/uploads/1/3/0/7/130775917/kusowogudupajuvil.pdfIn PDF document text
    • https://fowawuxubave.weebly.com/uploads/1/3/4/7/134759807/pejaviwabaris-pubaranazuradul-pekum-tugigoveruxofek.pdfIn PDF document text
    • https://sasenepekevob.weebly.com/uploads/1/3/4/2/134266747/gibud.pdfIn PDF document text
    • http://acelybio.com/upload/files/93560018590.pdfIn PDF document text
    • https://rizulibix.weebly.com/uploads/1/3/4/3/134358491/9523422.pdfIn PDF document text
    • http://ehomerealestate.org/images/file/lifakome.pdfIn PDF document text
    • http://quimis.net/js/ckfinder/userfiles/files/xesas.pdfIn PDF document text
    • http://crislbd.com/public/admin/assets/ckeditor/kcfinder/upload/files/65328026219.pdfIn PDF document text
    • https://crc.creativechange.net/ckfinder/userfiles/files/2365340529.pdfIn PDF document text
    • https://xezitolisaja.weebly.com/uploads/1/3/1/4/131406502/kuloregowipidiv_remalikazibisoz_muluxoti_xozaguj.pdfIn PDF document text
    • https://xamilugalaw.weebly.com/uploads/1/3/5/3/135325617/kedusiraweda_jagopugi_dosapuv_jexit.pdfIn PDF document text
    • https://jarofipe.weebly.com/uploads/1/3/1/4/131408229/15f518cf0e663.pdfIn PDF document text
    • https://lubagoxojijefam.weebly.com/uploads/1/3/4/5/134514049/teguxixubizuvad.pdfIn PDF document text
    • https://xizulorojude.weebly.com/uploads/1/3/5/3/135391297/a32cff4bc8.pdfIn PDF document text
    • http://planetpower-thefilm.com/plugins/kcfinder/upload/files/98245990478.pdfIn PDF document text
    • https://sebidodeg.weebly.com/uploads/1/3/4/4/134438526/pitenog_mokaxuz.pdfIn PDF document text
    • https://tedebewoxakiko.weebly.com/uploads/1/4/1/2/141255941/ea2c87c778c.pdfIn PDF document text
    • https://tutorsbureau.net/userfiles/file/mukib.pdfIn PDF document text
    • https://pezosoxebigaxox.weebly.com/uploads/1/3/4/3/134337327/9027886.pdfIn PDF document text
    • https://rupevedaloru.weebly.com/uploads/1/4/1/3/141317786/e87a12dd29.pdfIn PDF document text
    • https://kpk.1c.ru/admin/rc/ckeditor/kcfinder/upload/files/28516478428.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0007a6f3.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0007a6f3.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0007a6f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A6F3 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0007bf05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BF05 19008 bytes
SHA-256: 55ce86613663fa50383b9762c4b4cf716f3c92377359895cef745fa9aee28432
font_02_sfnt_off0007ef5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7EF5D 11080 bytes
SHA-256: fd922cd8f2164da48e70903e4457576bf3a2b004c3035319b5cfe32111d8a6f4

Open this report in the interactive analyzer, or submit your own file for analysis.