Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c853c15ff1fd69e…

MALICIOUS

PDF

376.0 KB Created: 2022-03-13 10:02:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-04
MD5: 085e1906a1f47606776f1395c43c20bb SHA-1: 9f0a48d2d77feac6193ac072906a0b9c70faf849 SHA-256: 2c853c15ff1fd69ec9c72e05991f0d889e428bfeec7261b88e71a2df0859f99f
184 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.3855

Heuristics 8

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
    PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cafij.co.za/XSRYdR1H?utm_term=free++blender+2.+75a PDF link annotation
    • http://nesthomes.in/userfiles/file/suzozolexuvozati.pdfIn PDF document text
    • https://www.anefescuela.es/files/91536524763.pdfIn PDF document text
    • https://tekstilkent.formenemlak.com/upload/ckfinder/files/vibunedom.pdfIn PDF document text
    • http://arisutour.com/ckupload/files/posipojejofiza.pdfIn PDF document text
    • http://hyosangjo.com/userfiles/file/20220202170737.pdfIn PDF document text
    • https://kossuth-csepel.hu/inc/kcfinder/upload/files/sidonefelemuj.pdfIn PDF document text
    • https://swaminarayangm.org/userfiles/file/22942192007.pdfIn PDF document text
    • http://tse.net.in/assets/ckeditor/kcfinder/upload/files/defozadoge.pdfIn PDF document text
    • https://shturnev.com/files/foFKED/file/mebotofomakafumotuxine.pdfIn PDF document text
    • http://medcentervrn.ru/userfiles/files/8800458048.pdfIn PDF document text
    • http://lotuscourtpune.com/wp-content/plugins/super-forms/uploads/php/files/a8adeea4176064dfa668bed77031c02b/mefavizoniwevuvuzuwur.pdfIn PDF document text
    • http://rkmaster.ru/uploads/files/2306222716.pdfIn PDF document text
    • http://uspeh-kursk.ru/ckfinder/userfiles/files/29287579876.pdfIn PDF document text
    • https://garmin1.ddbseven.cl/userfiles/file/womidurirer.pdfIn PDF document text
    • http://klusjesindex.nl/images/uploads/83268784870.pdfIn PDF document text
    • http://xn--oy2b9bv81anouola.com/upload/file/202202042143592009.pdfIn PDF document text
    • http://slenderclub.cz/ckfinder/userfiles/files/vuzaginunonimonuwovan.pdfIn PDF document text
    • http://skncn.com/u/files/suxezeneraz.pdfIn PDF document text
    • http://vwtint.com/userData/board/file/88180326032.pdfIn PDF document text
    • https://www.veedik.net/assets/admin/kcfinder/upload/files/87014141532.pdfIn PDF document text
    • http://overcomeproblems.com/images/files/fajukomokaruwo.pdfIn PDF document text
    • http://www.parkhillhigh.co.za/kcfinder/upload/files/jugezoju.pdfIn PDF document text
    • https://residencialconilcosta.es/kcfinder/upload/images/files/dizotomitabofapudivug.pdfIn PDF document text
    • https://pierrelemagicien.com/userfiles/file/89885753567.pdfIn PDF document text
    • https://nikken-engineer.jp/export/sd205/www/jp/r/e/gmoserver/8/6/sd0748886/nikken-engineer.jp/fckeditor/upload/file/6714428828.pdfIn PDF document text
    • http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1621e333704cd6---51719587186.pdfIn PDF document text
    • http://vanprodukt.cz/UserFiles/File/90368937751.pdfIn PDF document text
    • http://architettogherardi.eu/userfiles/files/ratiji.pdfIn PDF document text
    • http://noticiasdoms.com/userfiles/file///najaginixowiruwolezaxaj.pdfIn PDF document text
    • http://greathorserider.com/ckfinder/userfiles/files/57179627952.pdfIn PDF document text
    • https://hotelritariccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/1621264aa2f10c---59359702550.pdfIn PDF document text
    • https://postelezmasivu-praha.cz/ckfinder/userfiles/files/gozulunuxoveko.pdfIn PDF document text
    • http://skoleniridicubrno.cz/ckfinder/userfiles/files/43634471993.pdfIn PDF document text
    • http://mytenniscoach.net/admin/ckeditor/kcfinder/upload/files/18358905544.pdfIn PDF document text
    • http://ks-system.co.uk/ckfinder/userfiles/files/tepujoxogojomuzi.pdfIn PDF document text
    • https://www.mozartcantat.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1621b17eb6656d---598363865.pdfIn PDF document text
    • https://bulkleynechako.gocascadia.com/images/cms/file/ginekereveruxitiboritami.pdfIn PDF document text
    • https://volnynaklad.cz/data/file/tenatunabarupotajuvanipuf.pdfIn PDF document text
    • http://henca.com/files/details/file/mesanid.pdfIn PDF document text
    • http://www.slappedtogether.com/editoruploadfiles/file/pufaxu.pdfIn PDF document text
    • http://kd-council.com/upfile/files/rerikidum.pdfIn PDF document text
    • https://fceresources.com/ckfinder/userfiles/files/29051586769.pdfIn PDF document text
    • https://majubesar.info/contents/files/wuteku.pdfIn PDF document text
    • https://grandecentrepointhotels.com/upload/file/sekeziligazofisube.pdfIn PDF document text
    • https://www.ixpug.org/documents/1520629330Jaros-IXPUG-CINECABlender5.pdf[bareIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    +4 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0005167c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5167C 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_01_sfnt_off00052d99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52D99 25104 bytes
SHA-256: 29d9e6484fd95fc19160e985a4dcbc60ac555978130c51689a4aade3405ccbf9
font_02_sfnt_off00056fe9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x56FE9 10252 bytes
SHA-256: d3d7de3a1b32837658f31bca1e0dae6077dd846f5997d1eb262df757d0c0c7f5
font_03_sfnt_off0005872b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5872B 23804 bytes
SHA-256: f44a3cfb1c51f1d5460a7424afde34fd9803be6c9dcfa18d500bd725e54488f0

Open this report in the interactive analyzer, or submit your own file for analysis.