PDF malware analysis — malicious · 0d3a4b80cc2adc87

MALICIOUS

PDF

425.5 KB Created: 2022-02-01 15:23:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-14

MD5: 615055663d3edf108ee2700869409c3e SHA-1: 341ad3133a2760b2b896d82aa1d3d703dbc5f326 SHA-256: 0d3a4b80cc2adc8716d566076aa82c26ed3b21d5d05a1838910e94a10c84f0f2

136 Risk Score

Machine Learning

Nyx PDF Classifier suspicious score 0.4153

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://wirut.co.za/XSRYdR1H?utm_term=bhojpuri+bhakti+gana+song PDF link annotation
- https://nirmalujjwal.com/public/ckfinder/userfiles/files/putuluxejivibogufada.pdfIn PDF document text
- http://eros-arena.name/eros/userfiles/file/85493118448.pdfIn PDF document text
- https://olympicaccessoriesbd.com/assets/ckeditor/kcfinder/upload/files/xapebodisakukexa.pdfIn PDF document text
- http://alacarte-design.de/userfiles/file/julumajugebobepuratageji.pdfIn PDF document text
- http://tuderprogettazione.it/userfiles/files/48652524021.pdfIn PDF document text
- https://mcitalianwine.com/file/45266111050.pdfIn PDF document text
- http://hongshengfish.com/uploadfiles/20220129/2201290338424793926oyuh7lzd0bk.pdfIn PDF document text
- https://www.sdhbd.org/backend/web/kcfinder/upload/files/vujumamura.pdfIn PDF document text
- http://mtqindia.com/app/webroot/uploads/files/kediguti.pdfIn PDF document text
- http://www.solarwindependence.com/ckfinder/userfiles/files/66037114222.pdfIn PDF document text
- http://brucemsmithlaw.com/clients/e/e2/e252bfde01ef004f685a9648d307a4b9/File/44327274367.pdfIn PDF document text
- http://capitaldanceacademy.com/userfiles/files/famewirirogegujitodamix.pdfIn PDF document text
- http://faptvmedia.com/userfiles/file/74055558978.pdfIn PDF document text
- https://ventana-sur.com/wp-content/plugins/formcraft/file-upload/server/content/files/161b230114b510.pdfIn PDF document text
- http://parcroyale.hk/userfiles/ninomugutuzoriji.pdfIn PDF document text
- https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/0e27235519ae934d4829dcbda5a1bfb1/ribowoje.pdfIn PDF document text
- http://erbamedica.org/userfiles/files/kawagovitefakederawupabul.pdfIn PDF document text
- http://etasystem.net/userfiles/files/vaxapidopalomisujilolu.pdfIn PDF document text
- http://exteractif.fr/pictures/2/nadazudezetew.pdfIn PDF document text
- http://henca.com/files/details/file/60515693997.pdfIn PDF document text
- http://thucphamchucnangmy.vn/uploads/files/xojep.pdfIn PDF document text
- http://basic-55.su/kcfinder/upload/files/65374479982.pdfIn PDF document text
- http://webs.eusko-ikaskuntza.org/files/galeria/files/57747911952.pdfIn PDF document text
- http://thienlongadv.com/upload/files/vusuwodejitewubavabip.pdfIn PDF document text
- http://promocode.lu/userfiles/files/wewogi.pdfIn PDF document text
- http://contrast.no/ckfinder/userfiles/files/pakegule.pdfIn PDF document text
- http://askaudit.ru/price/gunape.pdfIn PDF document text
- http://lakshimi-kaatsu.com/user_data/packages/default/imgfiles/68437924216.pdfIn PDF document text
- https://handball-chac.com/docs/file/zubavoxos.pdfIn PDF document text
- http://sushinamu.com/uploads/files/nalemikewirilikeg.pdfIn PDF document text
- https://www.lindopoint.it/wp-content/plugins/super-forms/uploads/php/files/c979f03aca29cdaa726f2b58009525db/bipoforawepugixizuvumalu.pdfIn PDF document text
- https://martensmgt.com/business_school/uploads/file/43209929344.pdfIn PDF document text
- https://webvitamin.vn/app/webroot/uploads/files/86787113400.pdfIn PDF document text
- http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/161a6978e8f2a8---28664819276.pdfIn PDF document text
- http://www.tobywells.org/media/fckdir/file/84725041412.pdfIn PDF document text
- http://rwdwebwebdesign.com/img-aim/files/tiwoju.pdfIn PDF document text
- http://eclickapps.in/userfiles/files/96210842237.pdfIn PDF document text
- http://www.neoneofitou.com/ckfinder/userfiles/files/31752241146.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0006399a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6399A	17460 bytes
SHA-256: `478a6700dbf88094cab5447c4ef26e22f4f8123fb7a08e5b026195bad4c1d751`
`font_01_sfnt_off00066612.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x66612	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off00067d32.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x67D32	10868 bytes
SHA-256: `96192f25ff1624ae97eb8f8cb800a2c94e112ae9f96fb4e215d2854ec07c6f32`

Open this report in the interactive analyzer, or submit your own file for analysis.