Malicious PDF — malware analysis report

Static analysis result for SHA-256 1dccbf7b8b356ae6…

MALICIOUS

PDF

382.2 KB Created: 2022-02-25 10:50:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-05-30
MD5: f1b504f0a5961a64f3225c57dc3b0ee5 SHA-1: 182205941df07456f83ba50a59d8b18dbafb41e0 SHA-256: 1dccbf7b8b356ae646095484422650314832ae7dbcb2fcf78efe3adda7a694f7
144 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3989

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cafij.co.za/XSRYdR1H?utm_term=algebra+work+word+problems+pdf PDF link annotation
    • https://samsungklima.net/upload/ckfinder/files/xixisepa.pdfIn PDF document text
    • https://lerong.vn/wp-content/plugins/super-forms/uploads/php/files/3069a209ce23251c73b3cd1935bdc0ec/79026521367.pdfIn PDF document text
    • http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612053a17139e---78423367469.pdfIn PDF document text
    • http://tareeapartment.com/user_img/files/noliboduwopamowakiremel.pdfIn PDF document text
    • https://invision.buzyhub.com/files/12851299684.pdfIn PDF document text
    • http://forensique.biz/app/webroot/kcfinder/upload/files/71464370905.pdfIn PDF document text
    • http://tbvshungviet.com/upload/files/funoneweguvorutobinivijeg.pdfIn PDF document text
    • https://hcs1000.org/wp-content/plugins/super-forms/uploads/php/files/68d8807c670fb325edf20c9135fb0b18/74506373818.pdfIn PDF document text
    • http://mimarkamilozkartal.com/userfiles/files/13555772524.pdfIn PDF document text
    • https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/9qcegfsc4j83c31dkc62vuku1c/7888653177.pdfIn PDF document text
    • http://whatifitspossible.com/ckfinder/userfiles/files/bakafoxofikudopabav.pdfIn PDF document text
    • http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/161aa4a8f2933c---73284657753.pdfIn PDF document text
    • http://scsytech.com/upload/files/kexanugadebiwobilojob.pdfIn PDF document text
    • https://suacuacuontoanphat.com/upload/files/dozuzawomomokofope.pdfIn PDF document text
    • http://lngpetro.com/userfiles/file/werabeduwulafanomijamenat.pdfIn PDF document text
    • http://grouptm2.com/contents/files/safive.pdfIn PDF document text
    • https://pmeds.us/userfiles/file/gekaviwexutirunukadovukuj.pdfIn PDF document text
    • http://elcivan.com/admin/UserFiles/file/zatusigejureb.pdfIn PDF document text
    • https://www.supremecaravans.com.au/application/third_party/ckfinder/userfiles/files/11170718607.pdfIn PDF document text
    • http://winagain.co.za/kcfinder/upload/files/mozekogopanokave.pdfIn PDF document text
    • http://iktoktatas.hu/files/file/kokufimiduzidafavatulevad.pdfIn PDF document text
    • https://aawyx.com/sites/default/imageuser/file/vakaxipokax.pdfIn PDF document text
    • https://www.prowallpanama.com/wp-content/plugins/super-forms/uploads/php/files/d0ab0b0aae9c2fa31d2703f7812d9407/44464031026.pdfIn PDF document text
    • http://zs-g.jp/app/webroot/js/ckfinder/userfiles/files/94448062898.pdfIn PDF document text
    • https://callmarkinvestments.fortunekenya.com/callmark/files/82227385154.pdfIn PDF document text
    • http://shipsupply.ru/userfiles/files/logozi.pdfIn PDF document text
    • https://eliska.grenoo.sk/uploads/file/45482726217.pdfIn PDF document text
    • http://colorfusion.us/admin/images/file/43465856334.pdfIn PDF document text
    • http://standardamulet.com/files/files/29790193635.pdfIn PDF document text
    • http://www.gobarging.com/uploads/textareas/file/voromirujowesodegemowezik.pdfIn PDF document text
    • http://sncelamel-dz.com/app/webroot/assets/js/kcfinder/upload/files/7861137388.pdfIn PDF document text
    • http://zhizhencn.com/filespath/files/20211122120401.pdfIn PDF document text
    • http://rsst77.ru/upload/files/88558300166.pdfIn PDF document text
    • https://www.governancaparaobrasil.com.br/kcfinder/upload/files/zorowanixugami.pdfIn PDF document text
    • http://palirna-frydek.cz/uploaded/file/minisibamobifoka.pdfIn PDF document text
    • https://jairdefreitas.com/ckfinder/userfiles/files/35044349163.pdfIn PDF document text
    • https://marblo.com/app/webroot/img/files/fewopipokenede.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000570d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x570D6 16440 bytes
SHA-256: 84043553ba2a5f042e722156a0c55ea272c1156bfe1c8384d5734c0498f53051
font_01_sfnt_off00058794.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58794 18480 bytes
SHA-256: 892b3993ec2d7cd02d85ae704fbe43db2ed932fb4df7f7fb19d3079a19f8fa08
font_02_sfnt_off0005b7f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B7F5 10844 bytes
SHA-256: c70fa644370cdcba43cc2cec6f6ae45faca79d6743d2545bb710abdd4586b5e9
font_03_sfnt_off0005d0b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D0B8 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9

Open this report in the interactive analyzer, or submit your own file for analysis.