Malicious PDF — malware analysis report

Static analysis result for SHA-256 1afd912f2fd631bc…

MALICIOUS

PDF

87.5 KB Created: 2021-06-26 03:07:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: 97067b16064595aba4d7088575f8a4fe SHA-1: 33911ad48ebf3105df6b9985fc64397ed3ff9e45 SHA-256: 1afd912f2fd631bcea2ec552b9a4bae076261220878dc625608806b1247276ee
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for Pdf.Phishing.Trojan. The presence of numerous external URIs and link farms, many hosted on compromised WordPress sites, indicates a phishing or malware distribution attempt. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://krisoc.ru/uplcv?utm_term=important+chess+openings PDF link annotation
    • https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e79d170a96---44925490867.pdfIn PDF document text
    • https://ccveg.org/wp-content/plugins/super-forms/uploads/php/files/0vd2125bukpg8fnkfkmdpdivl8/siviravamutamepamo.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/792ulnvq5c5afh2fjts6s4fb0r/66169582981.pdfIn PDF document text
    • https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1609e307a70e20---godoraxefuvefaratom.pdfIn PDF document text
    • https://wlao.on.ca/wp-content/plugins/super-forms/uploads/php/files/a7e5401fb060ba0320bd42d2d3d60803/peritilejiv.pdfIn PDF document text
    • https://phoenixknights.co.uk/wp-content/plugins/super-forms/uploads/php/files/65bb37a1f446d02ea45527a9823c7248/zuwemebugejonelezekoki.pdfIn PDF document text
    • https://kalatranslation.co.uk/wp-content/plugins/super-forms/uploads/php/files/fpeidsuq0dcnldiobcnbr0rckm/lowavaw.pdfIn PDF document text
    • http://eske.hu/wp-content/plugins/formcraft/file-upload/server/content/files/160b62721b6da2---12197945782.pdfIn PDF document text
    • http://viviapalermo.com/userfiles/files/tuwelibazanabot.pdfIn PDF document text
    • https://eliteswimmingpoolsinc.com/wp-content/plugins/super-forms/uploads/php/files/kk04bd2u7i7r7ulepv1lficnb2/12867539937.pdfIn PDF document text
    • http://aucoindeshalles.fr/menu/file/21241899452.pdfIn PDF document text
    • https://munord.com/wp-content/plugins/super-forms/uploads/php/files/8b9193b61b2a10aa8f8920be80246f01/vuzavidujuteguvume.pdfIn PDF document text
    • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/160aabe8724e88---gulipe.pdfIn PDF document text
    • https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/65168a1ff000e179c5c13973dcfe87cd/24148876662.pdfIn PDF document text
    • https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607f5fe02b3cc---87266948738.pdfIn PDF document text
    • https://messianic.live/wp-content/plugins/super-forms/uploads/php/files/e26d102096267b77cb67786a4290a525/jekalaxenefite.pdfIn PDF document text
    • http://lifemartrealestateconnect.com/wp-content/plugins/super-forms/uploads/php/files/5ekflqq3t0vlcotre3qjt13d24/ditazaxedafepimawadum.pdfIn PDF document text
    • https://www.golaw.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b30dbe97af0---sazozapabikesufedivatapok.pdfIn PDF document text
    • https://sandalyecenneti.com/wp-content/plugins/super-forms/uploads/php/files/q229uft4eb8lid3bfdal16cvlb/fibilinisaxuvazazam.pdfIn PDF document text
    • http://contextuae.com/resimler/files/vepidimijulipegekeg.pdfIn PDF document text
    • http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/330a26b8f27af3be99fc4813523084c9/22705736359.pdfIn PDF document text
    • https://betenagro.com/sites/default/files/file/medorebozukuz.pdfIn PDF document text
    • https://ketdoanbus.com/webroot/img/files/18357305969.pdfIn PDF document text
    • http://dom-nenilovo.ru/wp-content/plugins/super-forms/uploads/php/files/703961b3cb51b586ccbe51781294eaeb/roterokudufubulores.pdfIn PDF document text
    • http://www.itbaloch.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082926573ec2---98132737030.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f556.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF556 16572 bytes
SHA-256: f27bf4f296c7761a4498fc6b43122d649649f51f935b916bc78e0f3a5ed0aec0
font_01_sfnt_off0001205d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1205D 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off00013874.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13874 10728 bytes
SHA-256: efaab7ee313c0f0debdd0718bc58e350ec247a0113939d0c6ff9fbe401a75687

Open this report in the interactive analyzer, or submit your own file for analysis.