PDF malware analysis — malicious · 191db36144db7918

MALICIOUS

PDF

103.6 KB Created: 2022-02-27 11:52:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-22

MD5: 2ad866435c1899942ad4d2814d655b39 SHA-1: 6374c6eab3b1af68f5f46e549795b74d79318ddd SHA-256: 191db36144db7918218765fdecb672feaf8f4ab295b0948bab03eb076b163d9d

164 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9812

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fecuq.co.za/XSRYdR1H?utm_term=belzona+1341+datasheet PDF link annotation
- https://floridainvestment.cz/files/file/zarinelexizorobobaxiv.pdfIn PDF document text
- https://www.beltiar.by/css/assets/plugins/kcfinder/upload/files/13868536651.pdfIn PDF document text
- http://www.ztc.hekko24.pl/panel/kcfinder/upload/files/munewevumekesedizagibofi.pdfIn PDF document text
- http://cnokorea.com/userfiles/file/46897039078.pdfIn PDF document text
- https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/160f02bdd471c9---77817887436.pdfIn PDF document text
- https://elesud.it/img_pagine/file/tusinaj.pdfIn PDF document text
- https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c15174384---buxojatira.pdfIn PDF document text
- https://iword.de/userfiles/file/45145338686.pdfIn PDF document text
- https://e-casainteligenta.ro/userfiles/file/xediwiwo.pdfIn PDF document text
- http://www.polni.si/Images/files/jikanidadides.pdfIn PDF document text
- http://hoangduy.vn/vn/files/39449574030.pdfIn PDF document text
- https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/pp6cff05fumv9fe9bine91km64/surukej.pdfIn PDF document text
- https://stormester.no/files/file/24443934427.pdfIn PDF document text
- https://wildnaturetravel.com/File/62279669479.pdfIn PDF document text
- http://biosurfest.com/userfiles/files/feverakowirus.pdfIn PDF document text
- https://cissud.com/uploads/ck_editor/files/sopusiduzinigebexivened.pdfIn PDF document text
- http://qcfloor.com/userfiles/file/15209569619.pdfIn PDF document text
- https://www.retailexpert.sk/gfx/administration/js/ckeditor/kcfinder/upload/files/45322462856.pdfIn PDF document text
- http://pawsandtiaras.com/ckfinder/userfiles/files/62294645885.pdfIn PDF document text
- http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/161e5a139170b8---87239903856.pdfIn PDF document text
- https://casasholidays.com/scgtest/team-explore/uploads/files/bokobujefigufafatugumozel.pdfIn PDF document text
- https://fontini-rozetki.su/kcfinder/upload/files/jubevixojuritavazofu.pdfIn PDF document text
- http://mislenyiallatorvos.hu/userfiles/file/95992776242.pdfIn PDF document text
- https://abh.net.br/kcfinder/upload/files/texaloxefoke.pdfIn PDF document text
- https://dnm.tw/uploads/files/202111031821335598.pdfIn PDF document text
- https://apteka-wratislavia.pl/halatecza/userfiles/file/17491646746.pdfIn PDF document text
- https://sodigital.it/wp-content/plugins/formcraft/file-upload/server/content/files/162093b9dce3ad---tugigifefaburonogolisufog.pdfIn PDF document text
- http://ritadas.in/userfiles/file/97954545125.pdfIn PDF document text
- http://lam.kiev.ua/kcfinder/upload/files/54745151978.pdfIn PDF document text
- https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610b82af7d506---60357410947.pdfIn PDF document text
- http://www.jindatunnel.com/up_files/file/towuvuveterewatunujo.pdfIn PDF document text
- https://amadesafar.ir/basefile/amadesafarir/files/dotuxe.pdfIn PDF document text
- http://www.allatpatikapecs.hu/images/file/fajafakoduwapugezi.pdfIn PDF document text
- http://nissanotogovap.com/uploads/images/files/83562482189.pdfIn PDF document text
- https://purmoradiatoriai.lt/images/files/99936393400.pdfIn PDF document text
- http://kino-profi.com/wp-content/plugins/super-forms/uploads/php/files/f64fad79b57540a596df26237de0dee7/rigasowenarosanax.pdfIn PDF document text
- http://hzqljsj.com/images/upload/File/19702204670.pdfIn PDF document text
- http://bestbuyfromindia.com/userfiles/file/30092531056.pdfIn PDF document text
- http://licausi.it/userfiles/files/popafikubisizexomopulemen.pdfIn PDF document text
- http://bangdinhphucat.com/quangbasanpham/app/webroot/upload/image/files/3176199599.pdfIn PDF document text
- https://automatisme-portail-bordazzi.fr/userfiles/fichiers/64586488332.pdfIn PDF document text
- http://2m-m.eu/userfiles/files/fosejelagowebefudowel.pdfIn PDF document text
- http://gomientrung.vn/uploads/image/files/17222446269.pdfIn PDF document text
- https://hoangnhataudio.vn/media/files/84518798778.pdfIn PDF document text
- http://mav-auto.ru/images/file/81810436096.pdfIn PDF document text
- http://bielwod.com/userfiles/file/volisevot.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
+5 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00013285.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x13285	10568 bytes
SHA-256: `7d45b57bb2092c2fdcaba7ac60be982b8fcf783a954a36ca679e7cbd67bae7e6`
`font_01_sfnt_off00014ac1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x14AC1	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off000161dc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x161DC	17372 bytes
SHA-256: `5ffb6f07a3b750a2d89e558c3ea04811bcf41cd70cb758fd17bccfa7a546e2a2`

Open this report in the interactive analyzer, or submit your own file for analysis.