PDF malware analysis — malicious · 0d3a15fa16fc3ee0

MALICIOUS

PDF

531.3 KB Created: 2022-02-08 05:01:56 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-14

MD5: 8697e6cab6b9593661e4f3221448ff82 SHA-1: e77fe5e0e6cc9d9e0755d4869515ac9a538d1ba3 SHA-256: 0d3a15fa16fc3ee00e279b61e778f8dec04d3d58835c78c00a83393b66f40666

136 Risk Score

Machine Learning

Nyx PDF Classifier suspicious score 0.3456

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://mifuj.co.za/XSRYdR1H?utm_term=moviesda+telugu+dubbed+movies PDF link annotation
- http://chinalabware.net/d/files/pifusipuwofakapuzotugog.pdfIn PDF document text
- http://prometric.ir/admin/upload/files/joxevajutar.pdfIn PDF document text
- http://jcmb.gris-de-payne.fr/app/webroot/kcfinder/files/mirejugoxapesesinenam.pdfIn PDF document text
- https://zniczekowalczyk.com/user_images/file/83628242166.pdfIn PDF document text
- http://vizit-k.net/uploads/editor/files/digaximu.pdfIn PDF document text
- https://chowdhurytourism.com/ckfinder/userfiles/files/fevisewiveketuro.pdfIn PDF document text
- https://kientrucmoi.com.vn/admin/kcfinder/upload/files/32300228908.pdfIn PDF document text
- http://elenasteele.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f5c1318c4e4---41685943277.pdfIn PDF document text
- https://deconkhoemanh.com/wp-content/plugins/super-forms/uploads/php/files/8emaivng0dscq7es41jht423dt/89224467769.pdfIn PDF document text
- http://energy-partner.pl/kcfinder/upload/files/34745905750.pdfIn PDF document text
- https://drticket.ir/basefile/drtiketcom/files/86111626346.pdfIn PDF document text
- https://dacinsara.ro/fckfiles/file/sukurexawinavato.pdfIn PDF document text
- https://micsys.in/userfiles/file/jadis.pdfIn PDF document text
- http://printific.com/images/contentimages/files/43614519620.pdfIn PDF document text
- http://engroupe.ca/aym_image/files/72464486472.pdfIn PDF document text
- https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/afe88278069489b8e895a257fea849de/mixokimamejogope.pdfIn PDF document text
- http://mebel-moscow.com/content/xuploadimages/file/86555649141.pdfIn PDF document text
- http://pinboulevard.com/file_space/files/nuzekubuge.pdfIn PDF document text
- https://fgcrubochi.com.ng/ckfinder/userfiles/files/vufuwizisowexoluzemefa.pdfIn PDF document text
- https://www.accidentinjurylascruces.com/wp-content/plugins/super-forms/uploads/php/files/0lfgq2q9nn9ptjk92nuqboriel/xupirewegufexoduworave.pdfIn PDF document text
- http://kedokteran.untan.ac.id/asset/ckeditor/plugins/kcfinder/upload/files/38209399721.pdfIn PDF document text
- http://nguyenphat.com/public/default/ckeditor/files/5333135110.pdfIn PDF document text
- http://bebcardkw.com/ckeditor-ckfinder-integration/uploads/files/suduzegibijeg.pdfIn PDF document text
- http://jockmurray.com/wp-content/plugins/formcraft/file-upload/server/content/files/16171abc3e5ead---batogutomabonafewow.pdfIn PDF document text
- http://avvolodin.ru/upload/file/70097679142.pdfIn PDF document text
- http://beautybybelief.com/admin/images/file/fulisudajixenerakerewe.pdfIn PDF document text
- https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/6859a3424d4b38f47b0ba7a0451a0078/fumobojavakuler.pdfIn PDF document text
- http://b40555.handyfriendship.com/upload/files/88953778204.pdfIn PDF document text
- http://katyababash.com/images/uploads/file/gudugidopuxo.pdfIn PDF document text
- http://program-pro.ru/userfiles/files/sugunipamu.pdfIn PDF document text
- http://nasledie-sluck.by/var/upload/file/59685359242.pdfIn PDF document text
- https://www.clinicaepilepsia.cl/ckfinder/userfiles/files/13594321131.pdfIn PDF document text
- https://dascalita.ro/app/webroot/files/userfiles/files/gagumunepenavoxokiku.pdfIn PDF document text
- http://simonide.org/userfiles/file/gasosexonubaku.pdfIn PDF document text
- https://thepetrichortouch.com/wp-content/plugins/super-forms/uploads/php/files/824g076dhhrr9ub19i6h60bm7j/88240712120.pdfIn PDF document text
- http://sukhonthip.com/file_media/file_image/file/57017578280.pdfIn PDF document text
- https://namratalakhotia.com/userfiles/files/fidekodokesejumitotitu.pdfIn PDF document text
- https://bisleriwheel.genefied.co/ckfinder/userfiles/files/kuwolo.pdfIn PDF document text
- http://www.pacautomarketing.com/file/letizekaw.pdfIn PDF document text
- http://kolasinprevoz.rs/slike/files/jividi.pdfIn PDF document text
- https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/161da5564be018---92324539125.pdfIn PDF document text
- https://wonkingchina.com/d/files/fimarabapasodetuwu.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
+1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0007e2d4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7E2D4	10688 bytes
SHA-256: `0233b670a8dc2fe2df8ba71e8e0e4fe704b7d70ada0ee9119fb8b464606d1caf`
`font_01_sfnt_off0007fb3a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7FB3A	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off00081257.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81257	16304 bytes
SHA-256: `d994351239ac78b44f7e6351bb21179bc71fd119408d8bed1121f0400e74434d`

Open this report in the interactive analyzer, or submit your own file for analysis.