Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff21d50e1c4829be…

MALICIOUS

PDF

263.0 KB Created: 2022-04-20 18:09:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-13
MD5: d5672abfe959ee910ad8e6cb8c47eb8f SHA-1: e79bde2147a426c8fd142fb83ccbb9cbff5e5eb7 SHA-256: ff21d50e1c4829be4c8783c492a66b092441fbf144c799a1d138ac49ac4d57d7
136 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7170

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zavodmdu.ru/userfiles/files/86500148734.pdf In PDF document text
    • https://vewejefimubi.weebly.com/uploads/1/3/4/1/134108794/zujobilavuxomepamusi.pdfIn PDF document text
    • https://lamobivuletopuk.weebly.com/uploads/1/3/4/8/134863798/sopazozokaruret.pdfIn PDF document text
    • https://migawonakizize.weebly.com/uploads/1/3/1/6/131637147/pitomon.pdfIn PDF document text
    • https://rilulukopidu.weebly.com/uploads/1/3/5/3/135323077/jufujizara-xenegijuv.pdfIn PDF document text
    • http://www.shriramhariram.com/kcfinder/upload/files/tezulewulipadexenulodel.pdfIn PDF document text
    • https://janhotels.posilatko.cz/files/wswg/files/vowerivenamogom.pdfIn PDF document text
    • https://icnj.net/ckeditor/ckfinder/userfiles/files/fefovubumal.pdfIn PDF document text
    • http://ingegnasrl.com/userfiles/files/20814461484.pdfIn PDF document text
    • https://faxipanonuk.weebly.com/uploads/1/3/4/3/134352952/sedan.pdfIn PDF document text
    • https://xitititoludazo.weebly.com/uploads/1/3/5/9/135987602/devewuxofu_podos.pdfIn PDF document text
    • https://dofisizowi.weebly.com/uploads/1/3/4/3/134327642/4493505.pdfIn PDF document text
    • https://geratezozadugul.weebly.com/uploads/1/3/4/3/134339700/1964584.pdfIn PDF document text
    • https://wixofixun.weebly.com/uploads/1/3/1/3/131379115/8191262.pdfIn PDF document text
    • http://guneyhukukburosu.com/panel/upload/files/38138802473.pdfIn PDF document text
    • https://womutiliwefol.weebly.com/uploads/1/3/5/9/135964171/7c22f325.pdfIn PDF document text
    • http://edu-tur.ru/userfiles/file/livabovivevevafu.pdfIn PDF document text
    • https://manekoso.weebly.com/uploads/1/4/1/4/141443680/6187745.pdfIn PDF document text
    • http://www.vycvikpreziti.cz/upload/files/20154993126.pdfIn PDF document text
    • https://tabupuja.weebly.com/uploads/1/3/4/6/134647436/vagefinaworo.pdfIn PDF document text
    • https://jatolesaz.weebly.com/uploads/1/3/4/6/134645106/c01265.pdfIn PDF document text
    • https://nobifopora.weebly.com/uploads/1/4/1/3/141389503/bamodusofilajaga.pdfIn PDF document text
    • https://pedutiwoda.weebly.com/uploads/1/3/4/4/134481784/0fbc92c3967045.pdfIn PDF document text
    • https://zolowokixo.weebly.com/uploads/1/3/0/7/130738875/8f5a3f42.pdfIn PDF document text
    • http://pbwi.com.pl/admin/kcfinder/upload/files/62150641608.pdfIn PDF document text
    • https://www.medicalart.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/161f9834ad8f88---85201189913.pdfIn PDF document text
    • https://lepabamun.weebly.com/uploads/1/3/1/6/131636917/wifinazefinaser.pdfIn PDF document text
    • https://nusoselif.weebly.com/uploads/1/3/4/4/134470887/fuzigukopa.pdfIn PDF document text
    • https://vatelepetelijul.weebly.com/uploads/1/3/4/7/134765631/13059a3906f354a.pdfIn PDF document text
    • https://kimilirakafame.weebly.com/uploads/1/3/4/6/134659192/0ec66889.pdfIn PDF document text
    • https://mulofujuxemo.weebly.com/uploads/1/3/0/8/130874025/4132844.pdfIn PDF document text
    • http://marta-galan.com/files/varios/file/simofek.pdfIn PDF document text
    • https://rivabugejovo.weebly.com/uploads/1/3/0/7/130739095/1677218.pdfIn PDF document text
    • http://ei-windykacja.pl/upload/file/tojexisanazut.pdfIn PDF document text
    • https://benodamefeju.weebly.com/uploads/1/3/5/3/135346815/zitaka-ratojuli.pdfIn PDF document text
    • https://sakixuso.weebly.com/uploads/1/3/4/4/134488330/rorali_ramod.pdfIn PDF document text
    • https://fiwugepupuladav.weebly.com/uploads/1/3/4/7/134740110/ed13efded2ead.pdfIn PDF document text
    • http://chinahk-ip.com/chinahk_ip/html/files/editor/file/rakulugetutiwe.pdfIn PDF document text
    • https://nosokubidudat.weebly.com/uploads/1/3/4/3/134321305/boferokatuwel_xofugegila_linumu.pdfIn PDF document text
    • http://hun777.hu/_user/file/gelamamukekipameseko.pdfIn PDF document text
    • https://jasuxazej.weebly.com/uploads/1/3/4/8/134875243/b53c960151d0.pdfIn PDF document text
    • http://skazka76.ru/pic/userfile/telipezemomoxek.pdfIn PDF document text
    • https://cafij.co.za/XSRYdR1H?utm_term=ais+140+guidelinesPDF link annotation
    • https://judesufewitudok.weebly.com/uploads/1/3/4/5/134592660/nosuz.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    +2 more URL(s)

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003ae64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AE64 17956 bytes
SHA-256: adc47711f3885ba86c16e1069c8fdea2caace47cd8324fc1523b8495bb5a9082
font_01_sfnt_off0003dce5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3DCE5 10276 bytes
SHA-256: 9c31bf6560917c6a1d5dd46a0c99a1d3aedae8b34cfc080f9abad756fb86d0f0
font_02_sfnt_off0003f3fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F3FA 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.