PDF malware analysis — malicious · 3dd34608610714e1

MALICIOUS

PDF

444.7 KB Created: 2022-03-03 02:48:15 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-25

MD5: 4758f4c48b3c179bbf1d1ca4dad1d619 SHA-1: ceda858e47d037ce8969c775bd0193a3058b9312 SHA-256: 3dd34608610714e19325dcff4d9c9135b99e7ceddfbf68f105a2acb415727079

144 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.5331

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yoyep.co.za/XSRYdR1H?utm_term=felt+board+templates+for+preschool PDF link annotation
- https://agro-zavod.ru/app/webroot/js/ckfinder/userfiles/files/63754846519.pdfIn PDF document text
- http://biopole-clermont.com/uploads/gestion_contenu/files/94398544097.pdfIn PDF document text
- https://wcfkenzi.com/ckfinder/userfiles/files/61839206003.pdfIn PDF document text
- http://stonepigments.com/userfiles/file/14980513226.pdfIn PDF document text
- http://snc.easy-event.net/img/uploads/files/kekarukujoliba.pdfIn PDF document text
- https://everestart.com/images/stories/file/45455267411.pdfIn PDF document text
- http://accessiblevehicleservices.com/userfiles/file/25479864725.pdfIn PDF document text
- http://barsugo.com/ckfinder/userfiles/files/95238642188.pdfIn PDF document text
- http://www.jindatunnel.com/up_files/file/givanuxa.pdfIn PDF document text
- http://transsegna.com/userfiles/gejedirokat.pdfIn PDF document text
- https://ismet.com.br/ckfinder/userfiles/files/davuxupinulow.pdfIn PDF document text
- http://wanyuantemple.tw/userfiles/file/27531467014.pdfIn PDF document text
- http://casim.se/kcfinder/upload/files/zexefodebimuzidosekolapew.pdfIn PDF document text
- https://currenwatch.myhost360.cn/file/upload/files/02-24-05-21-20-54.pdfIn PDF document text
- https://godahoian.com/app/webroot/upload/files/3635481186.pdfIn PDF document text
- https://www.a2zmedical.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1621ad8da7f3ef---vokofobewodipodipefov.pdfIn PDF document text
- https://jung.su/kcfinder/upload/files/wutuselifigabubilarigu.pdfIn PDF document text
- https://lombardpruszkow.pl/local/userfiles/file/votuj.pdfIn PDF document text
- https://stollerco.com/testingsites/advantage_aviation/assets/media/file/96774926867.pdfIn PDF document text
- http://kiajihlava.cz/UserFiles/File/76933075427.pdfIn PDF document text
- https://www.au-holding.ru/kcfinder/upload/files/lenawupovuxezanarivonaxag.pdfIn PDF document text
- http://hataylezzeti.com/resimler/files/29924295762.pdfIn PDF document text
- https://schreinerheusi.de/wp-content/plugins/formcraft/file-upload/server/content/files/1621ff4f58e728---8794258535.pdfIn PDF document text
- http://pphu-joanna.pl/fckpliki/file/15039758042.pdfIn PDF document text
- http://easy-sleep24.de/shop/images/editorfiles/file/zejotaxuz.pdfIn PDF document text
- http://onfireinteriors.com/userfiles/18913771066.pdfIn PDF document text
- http://dotacjedlaoze.pl/userfiles/file/82382287604.pdfIn PDF document text
- https://www.uralhelicom.com/frontend/web/js/kcfinder/upload/files/ligakugobisiroret.pdfIn PDF document text
- http://tvtamminhphat.com/uploads/userfiles/file/gaxokakaf.pdfIn PDF document text
- http://porpora.eu/imagenes/imagenes_contenidos///vapitor.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0006821c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6821C	10804 bytes
SHA-256: `7d5c0f1dce5d182c46aac776395e59405fce9d14ef1d3f57fc4e69270ca70d29`
`font_01_sfnt_off00069ad2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69AD2	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off0006b1ed.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6B1ED	18892 bytes
SHA-256: `5f8fdaa9801c269a69331933895388f1ff3d9ade9ae9f07614bd7cc1a241f420`

Open this report in the interactive analyzer, or submit your own file for analysis.