Malicious PDF — malware analysis report

Static analysis result for SHA-256 f964938fb3efe18a…

MALICIOUS

PDF

524.4 KB Created: 2022-04-04 22:08:06 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-03
MD5: f77453396085a69a6e1b806bda8ce1ff SHA-1: bdfdd00dfc01ad3bcc3298aa36169bf30cae78ae SHA-256: f964938fb3efe18a77d089b13d5af316ba0958474935922c72721b0873a4621c
106 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3620

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=que+es+el+cabello PDF link annotation
    • https://rexojufupul.weebly.com/uploads/1/3/4/5/134523972/8aae77b5587.pdfIn PDF document text
    • https://vubedupimobu.weebly.com/uploads/1/3/5/3/135314939/josob-vibazazag-wufejobuse.pdfIn PDF document text
    • https://giximelet.weebly.com/uploads/1/3/4/2/134234701/8547758.pdfIn PDF document text
    • https://lopadedabebaf.weebly.com/uploads/1/3/4/8/134897987/6632929.pdfIn PDF document text
    • https://semizafug.weebly.com/uploads/1/3/1/8/131871859/besodejap_menanakixufemek.pdfIn PDF document text
    • https://jakidanumamew.weebly.com/uploads/1/3/4/8/134881834/1607031.pdfIn PDF document text
    • https://visepawil.weebly.com/uploads/1/3/0/7/130776118/vejasivegafop-kezipi-jodosujire-fajovedovupamoz.pdfIn PDF document text
    • https://jatevabuxises.weebly.com/uploads/1/3/5/3/135382810/temidozuselog-xesuvodotadez-nemip.pdfIn PDF document text
    • https://gajodugibo.weebly.com/uploads/1/3/4/6/134635488/d5e9d9514d0d336.pdfIn PDF document text
    • https://wofogubegir.weebly.com/uploads/1/3/4/7/134728038/4f33fdf.pdfIn PDF document text
    • https://jukosixosibi.weebly.com/uploads/1/3/1/8/131871462/74c88f2.pdfIn PDF document text
    • https://miremawa.weebly.com/uploads/1/3/4/6/134631892/c031b.pdfIn PDF document text
    • https://likizosuzi.weebly.com/uploads/1/3/4/8/134886942/6779893.pdfIn PDF document text
    • https://migijulomav.weebly.com/uploads/1/3/5/3/135394851/tabif.pdfIn PDF document text
    • https://bisigategisabuv.weebly.com/uploads/1/3/4/8/134884720/1349643.pdfIn PDF document text
    • https://raxelapanaf.weebly.com/uploads/1/3/4/7/134746791/mowebefakudow_voxadujoz_pogunedopu_femasopekema.pdfIn PDF document text
    • https://zatitomumoz.weebly.com/uploads/1/4/1/2/141251393/voguxefipetirili.pdfIn PDF document text
    • https://vomedizi.weebly.com/uploads/1/3/5/3/135312409/xubavisi_xuninopod_dolon.pdfIn PDF document text
    • https://mabalavorejeg.weebly.com/uploads/1/3/4/7/134769590/vulapiluzoxum.pdfIn PDF document text
    • https://forilulan.weebly.com/uploads/1/3/1/4/131408022/najevirubupozod-mupanabosu-raxid-puxaxubi.pdfIn PDF document text
    • https://wiwofuda.weebly.com/uploads/1/3/2/3/132303082/pamifakavi-bijupovazikote-wedanepofexem-vagitono.pdfIn PDF document text
    • https://nirorozarijax.weebly.com/uploads/1/3/4/3/134342495/123172.pdfIn PDF document text
    • https://foxuginatumusex.weebly.com/uploads/1/3/0/7/130775376/3709870.pdfIn PDF document text
    • https://luwanolukurodo.weebly.com/uploads/1/3/5/3/135397368/gimuluterepozuron.pdfIn PDF document text
    • https://toxuxejegeze.weebly.com/uploads/1/3/5/3/135317786/vapejopasixaxuvok.pdfIn PDF document text
    • https://pagununida.weebly.com/uploads/1/3/4/8/134861868/jurobugesuzewil-dinuwezoxi.pdfIn PDF document text
    • https://tegikokawotivax.weebly.com/uploads/1/3/4/7/134759165/fc5d1ee8b1.pdfIn PDF document text
    • https://xunatopek.weebly.com/uploads/1/3/2/7/132710497/4691536.pdfIn PDF document text
    • https://lekozeva.weebly.com/uploads/1/3/5/9/135964777/2898054.pdfIn PDF document text
    • https://tufasibapot.weebly.com/uploads/1/3/4/7/134716176/78fd4e25c4b.pdfIn PDF document text
    • https://degexaxi.weebly.com/uploads/1/3/1/4/131406510/1535436.pdfIn PDF document text
    • https://xedexebil.weebly.com/uploads/1/3/4/2/134235570/xinaxidin-terorutifogivav.pdfIn PDF document text
    • https://tumafivefaj.weebly.com/uploads/1/3/3/9/133999435/niditugolajipo-tuvikitanazazas.pdfIn PDF document text
    • https://gosasolana.weebly.com/uploads/1/3/4/5/134523876/3be731.pdfIn PDF document text
    • https://tesafugefiwa.weebly.com/uploads/1/3/5/3/135318727/ruzunuko-kakujuz-vuzojezuwo.pdfIn PDF document text
    • https://pijafajabivigin.weebly.com/uploads/1/3/4/6/134635516/7292976.pdfIn PDF document text
    • https://gunobapeve.weebly.com/uploads/1/3/4/7/134706327/sotogifa.pdfIn PDF document text
    • https://koponabunabo.weebly.com/uploads/1/3/4/5/134520941/2751521.pdfIn PDF document text
    • https://jinogujejimitad.weebly.com/uploads/1/3/5/3/135392391/fc5fc46b9e2c49.pdfIn PDF document text
    • https://sunajojafexa.weebly.com/uploads/1/3/1/8/131856627/865744.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0007c229.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7C229 10128 bytes
SHA-256: cce4a0416316688e8182fc79e2ba6940f72dc8f04963ab2affee1a2afc7e82e9
font_01_sfnt_off0007d90a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7D90A 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0007f11c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F11C 18996 bytes
SHA-256: 689c4fcc0143b2ceb6cf51d0d5b8857fd1dc95fd1926ce0a8d08d172d14a36ff

Open this report in the interactive analyzer, or submit your own file for analysis.