PDF malware analysis — malicious · 3ddf5dc1e4d106c0

MALICIOUS

PDF

245.6 KB Created: 2022-02-12 13:08:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-26

MD5: 79f42b3b640d6f097a4f09cbc97805d6 SHA-1: ae920454df06fe1d67af247f10e2e6a8c8570420 SHA-256: 3ddf5dc1e4d106c01b8c61dcffc37f3470cad5ee5b6990477a4cce15ae0cdddd

214 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document contains embedded JavaScript and lures the user with a fake report, directing them to copy and paste content into a command-line interface. This suggests an attempt to trick the user into executing malicious commands, likely to download and run a secondary payload. The presence of multiple compromised CMS upload links and redirector URLs further supports a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.8211

Heuristics 8

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://colod.co.za/XSRYdR1H?utm_term=crude+oil+inventory+report+forecast PDF link annotation
- https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/capkp21v49su639i4k7rl31h2p/jifevinuwilugebuperafewi.pdfIn PDF document text
- http://thepokeluau.com/uploads/files/24997700023.pdfIn PDF document text
- https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615dbabe596ed---bureburivexuxa.pdfIn PDF document text
- https://grahampropertytax.com/wp-content/plugins/super-forms/uploads/php/files/b3407397c9a45b13eeb4db4ec3c6ac32/90860152459.pdfIn PDF document text
- http://tai-yang.tw/taiyang/upload/file/59902121026.pdfIn PDF document text
- https://ef.msfoody.com/upload/files/bikobosugivi.pdfIn PDF document text
- http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/161e6feaf27f32---42624982609.pdfIn PDF document text
- https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610d636d54f5f---dagereworob.pdfIn PDF document text
- https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e2a7506b501---59311546963.pdfIn PDF document text
- http://diamantina-joaillerie.com/ckfinder/userfiles/files/94260057656.pdfIn PDF document text
- http://przychodnia-felinskiego.pl/uploads/editor/file/74927905255.pdfIn PDF document text
- http://tsetv.kz/app/webroot/js/kcfinder/upload/files/dirimomugobobememirazoba.pdfIn PDF document text
- https://padservhosting.com/userfiles/file/zazamuxesezuzodipexexe.pdfIn PDF document text
- http://cbgnfinance.com/userfiles/file/80796538742.pdfIn PDF document text
- https://stehovani-ostrava.cz/static_pages_files/file/fanosabo.pdfIn PDF document text
- https://dallaslandscapedesign.com/media/files/30353258280.pdfIn PDF document text
- http://stauarchitetti.eu/userfiles/files/fexisuvilojur.pdfIn PDF document text
- http://bridgeonlaw.com/filespath/files/20220123205835.pdfIn PDF document text
- http://cappellastudio.it/userfiles/files/sosofigiferaluvepuxarit.pdfIn PDF document text
- http://it-hair.com/userfiles/wudusemel.pdfIn PDF document text
- https://samajsutra.com/userfiles/files/43216677224.pdfIn PDF document text
- http://azco.friend-match.com/upload/files/66911953462.pdfIn PDF document text
- http://h04ydivan.ru/userfiles/file/9529898150.pdfIn PDF document text
- https://art-gallery.mn/uploads/files/65105908912.pdfIn PDF document text
- http://globalone-mould.com/gbw/fckfiles/20211128134449.pdfIn PDF document text
- https://antonyfashion.sk/_upload/files/sigesevef.pdfIn PDF document text
- https://tunapvietnam.thietbiotoviet.com/Images_upload/files/xulaminefagegavaxo.pdfIn PDF document text
- http://msnladyboy.com/ckfinder/userfiles/files/wubifetujiwafabijetuze.pdfIn PDF document text
- http://brava-ekb.ru/userfiles/file/33392575701.pdfIn PDF document text
- https://lingchuanfloor.com/app/webroot/userfiles/files/kudasukizesapukot.pdfIn PDF document text
- http://arhive.np-sp.ru/img/file/484631576.pdfIn PDF document text
- https://fruitssupplier.com/app/webroot/img/files/zamuzixefozarirorupuzof.pdfIn PDF document text
- https://www.cukoyem.com.tr/wp-content/plugins/super-forms/uploads/php/files/8mo5ov19v5aubi2efb6hp0sg62/vopilojedefifakanipoturo.pdfIn PDF document text
- https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/161d46bdb9a71e---wazenujo.pdfIn PDF document text
- https://cosonnguyenthanh.vn/webroot/userfiles/files/nidoju.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0003699a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3699A	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_01_sfnt_off000380ba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x380BA	10924 bytes
SHA-256: `c1286503e82edfd2caab453bc0e0ba294046830c96b05ea6a1f93855bff175e8`
`font_02_sfnt_off00039a34.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x39A34	17176 bytes
SHA-256: `41264cedce5841662327a1608eba14e155f0f8f87cb8ff7519700416dcb6cdb8`

Open this report in the interactive analyzer, or submit your own file for analysis.