Malicious PDF — malware analysis report

Static analysis result for SHA-256 f998e764d836f95c…

MALICIOUS

PDF

86.9 KB Created: 2022-04-23 15:46:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-13
MD5: cb66fbb265347cffeba3659eaf95459d SHA-1: e92a3b88dc9b8fbeba8a4011090daa80730df3ac SHA-256: f998e764d836f95c86d988722a7227be3fb230e477390045d9796645e2dd6a9f
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9861

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lovig.co.za/XSRYdR1H?utm_term=acharya+aatreya+hit+songs+free PDF link annotation
    • https://xeforosoxipu.weebly.com/uploads/1/3/4/9/134900432/6960581.pdfIn PDF document text
    • https://viwitilabepimep.weebly.com/uploads/1/3/2/6/132695477/f494c5f.pdfIn PDF document text
    • https://puzagoliwosur.weebly.com/uploads/1/3/4/4/134462366/ruwetozuxedumesul.pdfIn PDF document text
    • https://gejizataki.weebly.com/uploads/1/3/3/9/133997606/rodedevuwudizug.pdfIn PDF document text
    • https://kagunalikabogow.weebly.com/uploads/1/3/5/3/135350350/2298794.pdfIn PDF document text
    • https://wobojuri.weebly.com/uploads/1/3/4/5/134598228/rajorutig.pdfIn PDF document text
    • https://divetuguwopad.weebly.com/uploads/1/3/0/7/130739619/42fcfc65df719c.pdfIn PDF document text
    • https://zulusoneruw.weebly.com/uploads/1/3/4/8/134887175/galepu.pdfIn PDF document text
    • https://niriretof.weebly.com/uploads/1/3/4/4/134488174/gakukuw_zakirekusiwe_fiwexejo_mabebipisax.pdfIn PDF document text
    • https://duweliga.weebly.com/uploads/1/3/4/5/134593675/8765111.pdfIn PDF document text
    • https://dupubevanedi.weebly.com/uploads/1/3/4/6/134649007/wezodisizutez-mizizifi-rutenetodol.pdfIn PDF document text
    • https://zesidorav.weebly.com/uploads/1/3/1/4/131437831/punawozeneburakuz.pdfIn PDF document text
    • http://hoogbegaafdennu.nl/userfiles/file/73630746610.pdfIn PDF document text
    • https://zoxuzula.weebly.com/uploads/1/3/4/4/134489613/a28cc2968.pdfIn PDF document text
    • https://bigifami.weebly.com/uploads/1/3/1/4/131407708/lowageganosawub.pdfIn PDF document text
    • https://kuwovuvonix.weebly.com/uploads/1/3/5/9/135971109/5414602.pdfIn PDF document text
    • https://fumunavizagoz.weebly.com/uploads/1/3/4/2/134235019/fubotatizoda-fivaxovofunilal-kakuvopujo-vunasopobuza.pdfIn PDF document text
    • https://rojanebe.weebly.com/uploads/1/3/1/6/131637229/3476708.pdfIn PDF document text
    • https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/pctt1skitiomrh642ji40k4l8j/mumoxemejepubodulitukujan.pdfIn PDF document text
    • http://australiandc.eu/uploads/ckeditor/files/mewimineku.pdfIn PDF document text
    • https://gebekogekikak.weebly.com/uploads/1/3/4/6/134694855/vipoligi_nurivosujugojo.pdfIn PDF document text
    • https://nodopemewave.weebly.com/uploads/1/3/2/6/132682748/saridaxur-moletosaxosedo.pdfIn PDF document text
    • https://sofupikibir.weebly.com/uploads/1/3/5/3/135302021/5796863.pdfIn PDF document text
    • http://wefocusdesign.com/upload/files/tujozomomapamifutisiwu.pdfIn PDF document text
    • http://red-persimmons.com/upfiles/editor/files/33686024340.pdfIn PDF document text
    • https://jeganani.weebly.com/uploads/1/4/1/3/141347175/654fd78da0d6.pdfIn PDF document text
    • https://fisenekapiwu.weebly.com/uploads/1/3/1/4/131437930/tisal.pdfIn PDF document text
    • https://vedabigejiko.weebly.com/uploads/1/3/1/4/131438046/sizufisapug.pdfIn PDF document text
    • https://dexuganepo.weebly.com/uploads/1/3/1/6/131608037/bajurudexalibikedow.pdfIn PDF document text
    • https://wumibatolazonik.weebly.com/uploads/1/3/1/4/131437616/3499608.pdfIn PDF document text
    • http://ivankotov.ru/img/lib/file/30231042227.pdfIn PDF document text
    • https://gilemana.weebly.com/uploads/1/3/5/3/135319463/1157485.pdfIn PDF document text
    • https://foseduvix.weebly.com/uploads/1/3/4/4/134491956/f9547ed.pdfIn PDF document text
    • https://nutukotixirijir.weebly.com/uploads/1/3/5/3/135392142/ribevavu.pdfIn PDF document text
    • https://xaborugerolute.weebly.com/uploads/1/4/1/3/141368325/4256029.pdfIn PDF document text
    • http://unibeauty.com.br/ckfinder/userfiles/files/mujemorilakumebud.pdfIn PDF document text
    • https://kedasolusezobu.weebly.com/uploads/1/3/5/3/135394891/jefalijugojimu-xejadibisim-lakekolavo-razim.pdfIn PDF document text
    • https://zoxaroga.weebly.com/uploads/1/4/1/4/141459656/3385855.pdfIn PDF document text
    • https://dilarutobafe.weebly.com/uploads/1/3/4/4/134456037/sajinafisog_tebajem.pdfIn PDF document text
    • https://www.liad-alger.fr/admin/style/js/edit/kcfinder/..%5Cimages%5Ccontenue/files/motorikabe.pdfIn PDF document text
    • https://dotigima.weebly.com/uploads/1/3/4/4/134404546/xabezenezazava.pdfIn PDF document text
    • https://kigolaris.weebly.com/uploads/1/3/1/3/131380971/xulirilo_limewuwinaxu_gapamu_xopikapa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    +1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e48d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE48D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_01_sfnt_off0000fca4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCA4 10664 bytes
SHA-256: f3e7f7be594cd40eb4b6a296b7defa952eec8d30aac9d7ce8b155431b1f7e0d4
font_02_sfnt_off00011524.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11524 21136 bytes
SHA-256: 88e6cf3f6cdb0fcb4e9dfdc71e8b0804260741a082234c0c57cfc31c0e9e6a07

Open this report in the interactive analyzer, or submit your own file for analysis.