Malicious PDF — malware analysis report

Static analysis result for SHA-256 f998d6eb8336bdb9…

MALICIOUS

PDF

197.4 KB Created: 2021-12-21 23:45:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-14
MD5: 19667f1e9be3db5778b79e16792c56b3 SHA-1: 28b29dcb7b7c94b4ce69ea22f2e276e12114725d SHA-256: f998d6eb8336bdb99fe2103a704a69bba7d6fcdcd41341584364dd119cbc3fb9
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.8518

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ksi-system.pl/editorfiles/file/12456992704.pdf In PDF document text
    • http://yaqeen-eg.com/userfiles/file/961706534.pdfIn PDF document text
    • http://hunting.kg/userfiles/file/mujitamoduwin.pdfIn PDF document text
    • https://ags-car.60km.com/upload/files/86759025936.pdfIn PDF document text
    • http://the100voicesofgospel.ch/fichiers/newsletter/file/kimagutafimax.pdfIn PDF document text
    • http://sugarfree-gelato.com/upload/file/47422973392.pdfIn PDF document text
    • http://studiopedrazzini.eu/userfiles/files/6561633256.pdfIn PDF document text
    • http://autosoftware.company/autoresponders_images/files/mejowivubekorid.pdfIn PDF document text
    • http://bangdinhphucat.com/quangbasanpham/app/webroot/upload/image/files/pimeferuxukuf.pdfIn PDF document text
    • https://artedeeducar.com.br/ckfinder/userfiles/files/bogukip.pdfIn PDF document text
    • https://ozsersogutma.com/upload/files/tewumazapis.pdfIn PDF document text
    • http://hindel-relax.ch/ckfinder/userfiles/files/dupiwuxifomojuk.pdfIn PDF document text
    • http://tetrafluoro.com/upload/files/21791590459.pdfIn PDF document text
    • http://www.its-dph.cz/admin/fckeditor/editor/userfiles/file/24727579985.pdfIn PDF document text
    • http://apmnir.ro/fckfiles/file/babomum.pdfIn PDF document text
    • http://dreiseengrundschule.de/files/xisuxulavifegexifi.pdfIn PDF document text
    • http://piscesappliances.com/userfiles/file/gilomakuxak.pdfIn PDF document text
    • http://tasteofruraleurope.eu/upload/File/gipagugibonavibidewamo.pdfIn PDF document text
    • http://checopharma.com/upload/files/19575788325.pdfIn PDF document text
    • https://askisan.com/upload/ckfinder/files/nolenilokodomalopojez.pdfIn PDF document text
    • http://vuatoyen.com/uploads/userfiles/file/ritizejudepugoz.pdfIn PDF document text
    • https://cam-ceeds.org/ckfinder/userfiles/files/69730179839.pdfIn PDF document text
    • http://wannawwannie.pl/userfiles/file/28253115294.pdfIn PDF document text
    • http://myphamlulanjina.com/upload/files/80584315959.pdfIn PDF document text
    • http://feedproxy.google.com/~r/Xvkpad/~3/2I9n2o-U8HI/uplcv?utm_term=calculus+on+manifolds+solutions+pdfPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002ab46.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AB46 17248 bytes
SHA-256: ae64eef4c142781ab2d8329337714d39a11f28f089c6ac7494a8704dbb740e9e
font_01_sfnt_off0002d7d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D7D6 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336
font_02_sfnt_off0002ee7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EE7A 10680 bytes
SHA-256: 0d27d5cd3440cd7742c2425c6b778091731775c3f8a59f81a896568d8c9c93bd

Open this report in the interactive analyzer, or submit your own file for analysis.