Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2953370af7a31ad…

MALICIOUS

PDF

279.0 KB Created: 2022-05-28 05:54:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-26
MD5: f9008f392ee4d50613896243cebf5f12 SHA-1: 6086916f968ab0b7ba233d90b0595f89fc72aeed SHA-256: f2953370af7a31ad01ca5be55779056d203e3fbb3d819bdd379336830bd31879
196 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5647

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wirut.co.za/XSRYdR1H?utm_term=the+lean+product+playbook+summary+sheets+printable PDF link annotation
    • https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/e569bd32c28505ad5621aa18cf078c3d/korolamitozedirumaji.pdfIn PDF document text
    • http://fine-cottage.ru/userfiles/file/15474271986.pdfIn PDF document text
    • https://pupaxutakigi.weebly.com/uploads/1/3/4/5/134579126/1071161.pdfIn PDF document text
    • https://kedigijolaga.weebly.com/uploads/1/3/4/3/134331451/tebale.pdfIn PDF document text
    • http://stinpo.com/ckfinder/userfiles/files/84398100032.pdfIn PDF document text
    • https://icaiaa21.scrs.in/kcfinder/upload/files/81618040137.pdfIn PDF document text
    • https://dpmptsp.pemkomedan.go.id/dpmptspwebaplikasi/libraries/ckeditor/kcfinder/upload/files/24094274765.pdfIn PDF document text
    • https://gokenirubup.weebly.com/uploads/1/4/1/3/141344669/gutodure_pagufo_pumamalakalope.pdfIn PDF document text
    • http://yljinbiao.com/admin/upFile/2022-4/file/gojekikodikabefofo.pdfIn PDF document text
    • http://camberwelltaxi.com/survey/userfiles/files/pipogalu.pdfIn PDF document text
    • https://dafavazama.weebly.com/uploads/1/3/4/8/134893815/badosedevazugoz-volebagovo-xelezaponoxos.pdfIn PDF document text
    • https://ana-jsc.com/upload/files/vuzuduxilizepidifaf.pdfIn PDF document text
    • https://desarrollostecnologicos.condotiero.com/imagenes/imgeditor/file/46404133433.pdfIn PDF document text
    • https://pmayassam.in/assets/kcfinder/upload/files/85658959309.pdfIn PDF document text
    • http://submission.jpvm.kr/pds/userfiles/files/timemufobikebolu.pdfIn PDF document text
    • http://flathead.herosuite.com/userfiles/file/26374333900.pdfIn PDF document text
    • https://bepupigo.weebly.com/uploads/1/3/4/3/134317889/nikifopa.pdfIn PDF document text
    • http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/162048c981db85---17450158145.pdfIn PDF document text
    • https://jimsdelibrookhaven.com/demo/jimsdeli/admin/userfilesfile/85244809323.pdfIn PDF document text
    • https://pulisojoperun.weebly.com/uploads/1/3/4/4/134487891/fuvag_tebilirin.pdfIn PDF document text
    • https://cheeselicious.net/UserFiles/file/3486364443.pdfIn PDF document text
    • https://jojurofi.weebly.com/uploads/1/3/4/6/134666092/1933844.pdfIn PDF document text
    • https://zexunipubu.weebly.com/uploads/1/3/4/8/134877105/mugugarapipagi_zagabavofupolu.pdfIn PDF document text
    • http://haciogullari.com/depo/sayfaresim/file/rasumupukexa.pdfIn PDF document text
    • https://serutoposax.weebly.com/uploads/1/3/5/3/135398922/2363561.pdfIn PDF document text
    • http://h-p-n.fr/catalogue_dynamique/file/29140899577.pdfIn PDF document text
    • https://dozukasek.weebly.com/uploads/1/4/1/6/141617816/xefovomorevur_tatuteva.pdfIn PDF document text
    • https://doxujivadew.weebly.com/uploads/1/3/4/8/134875716/jekufebawaxowazas.pdfIn PDF document text
    • https://badaranquehablar.com/userfiles/files/42409374811.pdfIn PDF document text
    • https://boliroxido.weebly.com/uploads/1/4/1/5/141575057/zolufinat.pdfIn PDF document text
    • http://maryalo.com/userData/board/file/rewesusas.pdfIn PDF document text
    • https://mavieromantique.com/images/files/26230116825.pdfIn PDF document text
    • http://ylwjx.yun2u.cn/upload/files/zosujititevesefepenutakut.pdfIn PDF document text
    • https://zipezeroluxufa.weebly.com/uploads/1/3/4/9/134904793/6929287.pdfIn PDF document text
    • https://macauroommate.com/ckfinder/userfiles/files/99536751633.pdfIn PDF document text
    • https://dernek.daynexdemo.tk/upload/ckfinder/files/gufibilusotukapavavate.pdfIn PDF document text
    • https://sugevemaketajes.weebly.com/uploads/1/3/4/8/134873201/473730.pdfIn PDF document text
    • https://sasawosoj.weebly.com/uploads/1/3/4/3/134334432/5ccb48a49977f.pdfIn PDF document text
    • http://baracenter.be/userfiles/file/42036697699.pdfIn PDF document text
    • https://surapurefolax.weebly.com/uploads/1/3/5/3/135327325/zudezusij.pdfIn PDF document text
    • https://noxerurivago.weebly.com/uploads/1/3/4/7/134767941/gugudosusof.pdfIn PDF document text
    • http://buyuksahinbeyasm.com/depo/files/losemen.pdfIn PDF document text
    • http://karinameal.com/imgdish/files/tiputamikidilixabu.pdfIn PDF document text
    • https://marblobaths.ph/app/webroot/img/files/8683236287.pdfIn PDF document text
    • https://miriziwu.weebly.com/uploads/1/3/0/7/130774981/8183630.pdfIn PDF document text
    • http://bilcafe.it/userfiles/file/4617851139.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    +5 more URL(s)

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003eedc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EEDC 11188 bytes
SHA-256: fe205ae6d01ab7f29bff41f72e28f41ff194064f60776f1d1ec29741ecada0a8
font_01_sfnt_off000408a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x408A4 16352 bytes
SHA-256: 6e29a7b4842a98ec20204de27a4d3fa27c3a60aedc8956edd1b5245e1946a1d9
font_02_sfnt_off000432bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x432BF 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.