Malicious PDF — malware analysis report

Static analysis result for SHA-256 224a6712bfa5f221…

MALICIOUS

PDF

373.0 KB Created: 2022-03-25 15:07:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-04-23
MD5: 7d24e251a74efb644f24f8f09fdabaa0 SHA-1: 85aab7eca9096d2b5a5c1f3fe4e52eda396b082c SHA-256: 224a6712bfa5f221a94e38459cf71a37595dadc631716e969b8e782f3b322333
166 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5595

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://loheb.co.za/XSRYdR1H?utm_term=cities+in+palm+beach+county+map PDF link annotation
    • http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/1622af5d29a649---gexajetepil.pdfIn PDF document text
    • http://opt-russtd.ru/data_center/upload_pictures/file/84119751475.pdfIn PDF document text
    • http://studioagm.it/userfiles/files/31685831232.pdfIn PDF document text
    • http://lezeckastenakosice.sk/upload/files/6594548434.pdfIn PDF document text
    • https://abcoegypt.com/userfiles/files/93142072134.pdfIn PDF document text
    • http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16204a37de66ea---jolabuzijamilowudixeluju.pdfIn PDF document text
    • http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/1622e69da7cfc0---voxidedelotuv.pdfIn PDF document text
    • https://posetili.ru/userfiles/file/detebodolijokaxiguja.pdfIn PDF document text
    • http://cissi.it/userfiles/files/vupejaju.pdfIn PDF document text
    • http://azinsaghf.com/cache/fck_files/file/fowonumijeliralot.pdfIn PDF document text
    • https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/tr1ai21v5n9nb01u9n3ukhun7k/dusamopuko.pdfIn PDF document text
    • http://naszemotyle.natura2000.pl/imgturysta/files/73151514600.pdfIn PDF document text
    • https://twojeloty.pl/admin/kcfinder/upload/files/tuwulegalinogat.pdfIn PDF document text
    • https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622f8f0b4a517---63194132039.pdfIn PDF document text
    • http://tua-hatextiles.com/assets/ckeditor/kcfinder/upload/files/24436257152.pdfIn PDF document text
    • http://shinhwajudan.com/userData/board/file/dixizidude.pdfIn PDF document text
    • https://cqc-material.com/app/webroot/userfiles/files/zeruladipekufogesif.pdfIn PDF document text
    • http://mindatpeace.us/uploads/files/nogegafuteboxuwifir.pdfIn PDF document text
    • http://customartdirect.com/kcfinder/upload/files/15879105839.pdfIn PDF document text
    • https://atarentacarburdur.com/userfiles/file/97825240499.pdfIn PDF document text
    • https://yourwebcenter.com/files/file/26246060303.pdfIn PDF document text
    • http://www.vyroba-plastovych-bazenu.cz/upload/files/69843991850.pdfIn PDF document text
    • http://www.museopizarra.com/ckfinder/userfiles/files/59889001316.pdfIn PDF document text
    • https://fac.apuntoweb.com/userfiles/files/2228679112.pdfIn PDF document text
    • http://rcchoir.nl/upload/files/92273946010.pdfIn PDF document text
    • http://gagutp.com/sa_upload/userfiles/file/20220209112931.pdfIn PDF document text
    • http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16215755a6358c---pebudo.pdfIn PDF document text
    • http://canadianrockies.info/files/file/kirawasodugatus.pdfIn PDF document text
    • http://upoart.com/ckfinder/userfiles/files/kidagujitogimodiwoboxon.pdfIn PDF document text
    • http://hardevel.com/data/files/nixazunalu.pdfIn PDF document text
    • http://skene.es/userfiles/file/83448400700.pdfIn PDF document text
    • http://malabarisproducoes.com/arquivos/files/robazo.pdfIn PDF document text
    • https://vivaldiroberto.com/img/files/mediafiles/file/xevakejosiwubol.pdfIn PDF document text
    • https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/161fdf67aeecc5---demekubixapizuvun.pdfIn PDF document text
    • http://393citizen.com/upload/files/titatu.pdfIn PDF document text
    • https://hungarogun.hu/feltoltes/files/61845088357.pdfIn PDF document text
    • https://advokati-ufa.ru/uploads/files/dozibafarekubovadivik.pdfIn PDF document text
    • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16217bfa473e3e---26955507977.pdfIn PDF document text
    • http://shopgraeagle.com/ckeditor/uploads/files/zowijadatin.pdfIn PDF document text
    • http://www.wiz-fac.com/uploadImg/file/rimevabaxatukirutalivil.pdfIn PDF document text
    • https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/0dg4b53vi91l26igt5cb4lurag/13397093943.pdfIn PDF document text
    • http://kedehg.com/ckfinder/userfiles/files/29833821947.pdfIn PDF document text
    • http://www.toptehnik.si/images/gofalibebo.pdfIn PDF document text
    • http://rutka.pl/media/upload/files/911b3bbb9aeb0620c02fae1d7e4dcdfe.pdfIn PDF document text
    • https://www.tonygssoulfood.com/wp-content/plugins/super-forms/uploads/php/files/66add38ed26d1351a23eacc35948cd20/faxat.pdfIn PDF document text
    • https://habibitours.org/ckfinder/userfiles/files/xubagoxobiz.pdfIn PDF document text
    • https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/ana7iv4i4slh5efb7cncqgdu99/27972047310.pdfIn PDF document text
    • https://maleki-group.ir/js/kcfinder/upload/files/83525809765.pdfIn PDF document text
    • http://xn----8sbemnkjd7bfu.xn--p1ai/design/img/upload/file/gelajibeviporomarusi.pdfIn PDF document text
    +9 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00055fbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x55FBB 10924 bytes
SHA-256: 8e978c12afb2d0e5d45f330ca4ec0b5aac4d90c8f152cc5e9260dbc05759b03e
font_01_sfnt_off000578af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x578AF 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_02_sfnt_off00058fce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x58FCE 19024 bytes
SHA-256: 80dbfa6b0e827e4f7937c128abed9f2ea8d4bddddc93eb5c7f18614d02a9435b