PDF static analysis report

Static analysis result for SHA-256 fe09928ccce6cfa5…

SUSPICIOUS

PDF

454.7 KB Created: 2022-07-29 09:17:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-03
MD5: 828057590cc9c42216d85af400b5668a SHA-1: 417befe860b8f9c053d7afb98a807a55d48293e2 SHA-256: fe09928ccce6cfa5500d5fec34331966bae6faaff0b7897f05b95c86c668f132
46 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4050

Heuristics 4

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.leasebridge.com/CKUPimg/files/76083040146.pdf In PDF document text
    • https://agencement-menuiserie-var.fr/stockages/files/88081701894.pdfIn PDF document text
    • http://vector-luczak.pl/new/fck_user_files/file/46610424589.pdfIn PDF document text
    • https://fusupolupiritox.weebly.com/uploads/1/3/4/3/134374508/mekigukikewujojikusi.pdfIn PDF document text
    • https://totiboliz.weebly.com/uploads/1/3/4/8/134897880/9893219.pdfIn PDF document text
    • https://gukikaxut.weebly.com/uploads/1/3/0/7/130775725/6311117.pdfIn PDF document text
    • https://kerijene.weebly.com/uploads/1/3/4/3/134367262/1644347.pdfIn PDF document text
    • http://xn--aknmedical-yub.com/uploads/file/25020587290.pdfIn PDF document text
    • https://pexazunawilaga.weebly.com/uploads/1/3/4/2/134265520/660695.pdfIn PDF document text
    • https://actionalbertafoundationrepair.com/nbloom/fckuploads/file/todedufijuxuvuvuwidujoreg.pdfIn PDF document text
    • https://tuxiwuke.weebly.com/uploads/1/3/4/6/134611110/1009058.pdfIn PDF document text
    • https://sajejedazo.weebly.com/uploads/1/3/3/9/133999783/zosora_disafexaxarojo.pdfIn PDF document text
    • https://kazirevuteguzug.weebly.com/uploads/1/3/2/6/132681824/wabipefuvanegur.pdfIn PDF document text
    • https://jagojepenita.weebly.com/uploads/1/3/0/7/130739472/6249508.pdfIn PDF document text
    • https://xuvimotevezesi.weebly.com/uploads/1/4/1/9/141948081/podemuraxatib_dogasoroba_guminexutadijav_damavunegawu.pdfIn PDF document text
    • https://supowajupita.weebly.com/uploads/1/4/2/4/142441497/pefitalawi_vivomozevefifuv.pdfIn PDF document text
    • http://xeltuve.com/c3?utm_term=ligularia+reniformis+wikiPDF link annotation
    • http://www.vivelamusica.es/wp-content/plugins/formcraft/file-upload/server/content/files/162ac6b548bdbd---36325808718.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62d295cd0871b177c3fe7fe0/1657968078170/nelijuxeziza.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62d3bc7d6652c0350aec98fe/1658043517513/fraction_attraction_answer_key.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62d6f46dcc102f755784c34f/1658254445761/50748880008.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62e1970f9f41ec353ccb5508/1658951440508/garena_speed_drifters_car_guide.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62bd6f5d2b11d853ce56330d/1656581981757/wixidovusisekubebexuzelu.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62c22142cf740c2a5f58b8f7/1656889667317/nazojopufetazab.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62c6b3fd6f3f6f125e086b3a/1657189373214/why_don_t_students_like_school.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62c3652df91a6a40045b36cd/1656972590363/56029970465.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62db50f63c24991b558a14e1/1658540279416/boss_hindi_movie_songs_download_320kbps.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b2ed1428ace74cd92c43c7/1655893268672/sutovagugoke.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aebe5436e397a99d53e8a/t/62dd80b8fb41ba4dc9835248/1658683576615/just_give_me_a_reason_lyrics_downloa.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62d4ab7b5552ee2faca4a00a/1658104699814/usps_city_carrier_assistant_hours.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62d24d1c3899d8105aef6ea0/1657949469383/wamemewunudatojaxodezed.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62b4701a15e0834735cbd9a7/1655992347185/ceph_snapshot_performance.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62b78e6416eb1d4dd6b56399/1656196709299/mebezugasuguxetemo.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62dd0fc6c66f5e4cd8a88dcd/1658654662726/walking_tour_of_nyc_christmas_window.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62bb7b37c2174e0a1e0ba2c0/1656453944011/80122145025.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62cd61d94ec4ea61baa37805/1657627097812/descriptive_words_to_describe_the_sunset.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62d42b6d08bfab66093ef7db/1658071918363/danzig_baldaev_drawings_from_the_gulag.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62e251e2cdae4514b2f147f9/1658999267326/94215910111.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62ba697f65d6ec50c81880b2/1656383871972/sobolefosesu.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aec14af289a5f7a539cf5/t/62d63a92445da14249693b61/1658206867444/20991637330.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62ba570767459111075ba160/1656379144199/6434552976.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf27c8bac0413e6f804fa/t/62e0b524198d9b431559f6fc/1658893605023/amd_radeon_520_gaming_performance.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aea6a97201213e037dc4e/t/62cf4acfac327e18562139d1/1657752271579/bigjon_pc_games_download.pdfIn PDF document text
    • https://static1.squarespace.com/static/604aeb86718479732845b7b4/t/62ccad2c1a929c505ed6e6fd/1657580844323/lux_aeterna_ligeti_sheet_music.pdfIn PDF document text
    • https://static1.squarespace.com/static/60aaf25e42d7b60106dc17aa/t/62b48f1a29a82c3608c35f7c/1656000282723/mastering_chemistry_pearson_answers_chapter_4.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    +3 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0006b637.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B637 2260 bytes
SHA-256: 0dafad3410142a6b97b69391c9784b8294ce0a227d004d82e4b2664fa5d7e6ce
font_01_sfnt_off0006c021.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C021 19444 bytes
SHA-256: 7974fb9d15b4e80fb0c2045ba0bf7e672413edd0e931e6f4c714ec3bb670b877
font_02_sfnt_off0006f1ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F1AC 10692 bytes
SHA-256: 45a0fa68a518c3d9eb0ea97a723d7d3179db19f68d3b686569df77fd241c819b