Malicious PDF — malware analysis report

Static analysis result for SHA-256 f87aefdb37acefcb…

MALICIOUS

PDF

282.7 KB Created: 2022-04-05 00:07:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-16
MD5: 833823eb21b7128af1b99741d6e9a91c SHA-1: 9166527890ee4fe22c3af8bc8b7aa14ac6389f45 SHA-256: f87aefdb37acefcba1b1476c88eef52689506bec9dcae7a3133bebf2c0ffbf51
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.6806

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fecuq.co.za/XSRYdR1H?utm_term=silent+witness+bbc+episode+guide PDF link annotation
    • https://tazififodokufu.weebly.com/uploads/1/3/0/7/130776891/giwadufurejugix_lovomalivifos_murofenogizel.pdfIn PDF document text
    • http://www.mswest.co.jp/cmsdesigner/kcfinder/upload/files/ronuxesubaxopexefezugovu.pdfIn PDF document text
    • https://fotagajumiveba.weebly.com/uploads/1/3/1/4/131411987/vatitite.pdfIn PDF document text
    • https://istihdamhaberleri.com/upload/ckfinder/files/sewilozoseguwiririvow.pdfIn PDF document text
    • http://funagamex.vn/PhuongNamGroup/userfiles/files/59401713494.pdfIn PDF document text
    • https://tobopitoru.weebly.com/uploads/1/3/4/8/134872655/voresejelajalugilez.pdfIn PDF document text
    • http://ncfc.com.tr/ckfinder/userfiles/files/5271008240.pdfIn PDF document text
    • https://tedevonefuses.weebly.com/uploads/1/3/4/5/134528644/5656c37312348.pdfIn PDF document text
    • https://barosowuni.weebly.com/uploads/1/3/1/3/131398377/3074852.pdfIn PDF document text
    • https://vimiwegom.weebly.com/uploads/1/3/0/7/130775837/c4cad105ea.pdfIn PDF document text
    • https://pimelotug.weebly.com/uploads/1/3/4/5/134576353/1311f3.pdfIn PDF document text
    • https://veburuja.weebly.com/uploads/1/3/0/7/130739173/vezokupepuxedut-novejelufus.pdfIn PDF document text
    • https://wivevesatowot.weebly.com/uploads/1/3/0/8/130813399/1b9c7494b5f4.pdfIn PDF document text
    • https://bak.vn/upload/files/52416115009.pdfIn PDF document text
    • https://xasigebopij.weebly.com/uploads/1/3/0/7/130775268/f9a00a5.pdfIn PDF document text
    • https://bukojawuwo.weebly.com/uploads/1/3/4/5/134508808/3485690.pdfIn PDF document text
    • https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/162349d63c6aa3---gepik.pdfIn PDF document text
    • http://cosmikkino.ru/sadm_files/tajazolakavezefobewekuj.pdfIn PDF document text
    • https://powujuraw.weebly.com/uploads/1/3/5/3/135321569/nadajo-gujinaxarilu.pdfIn PDF document text
    • https://neripekotijoba.weebly.com/uploads/1/3/2/6/132681370/luwuwufivofo_makokev.pdfIn PDF document text
    • https://eagleegg5k.com/ckfinder/triplebuserfiles/file/ranirudukukisu.pdfIn PDF document text
    • https://sepiximefajo.weebly.com/uploads/1/3/4/8/134849953/7504433.pdfIn PDF document text
    • https://zejabunu.weebly.com/uploads/1/3/4/7/134719965/rupenu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003e39f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E39F 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0003fbb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3FBB0 16220 bytes
SHA-256: 207eb3b51995adbdef2a766e0364e2c2ee182a7f0f0647c12a4a3807efc046f6
font_02_sfnt_off00041195.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41195 10828 bytes
SHA-256: 7841c47b8fff80e8f32952b6ef6057fd75849e5aeeb33000370799fa4605cd3c
font_03_sfnt_off00042a3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42A3D 19028 bytes
SHA-256: d863ad5126ba10cbc7a8ecbc604517e40cc4146fa6adf1f4c73e057cfc8a99e4

Open this report in the interactive analyzer, or submit your own file for analysis.