PDF malware analysis — malicious · 42560be72df2f962

MALICIOUS

PDF

240.8 KB Created: 2022-02-09 09:50:02 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-16

MD5: 577b647c6bba92aa7aae87133481e25f SHA-1: d919ac62fe87f601704d46d04bffd5b752dcbd4f SHA-256: 42560be72df2f962bb8e04b1e3eaa190e9efbded9b62e6cc75e24f402ca2648d

174 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.5785

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lazav.co.za/XSRYdR1H?utm_term=stihl+chainsaw+250+manual PDF link annotation
- https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/4el96h64991c3n9agc99vouf5q/penetepefoj.pdfIn PDF document text
- https://bbensonmft.com/wp-content/plugins/super-forms/uploads/php/files/2569998580ea57410f286120a3e72953/xefixiru.pdfIn PDF document text
- https://karthikaspices.com/uploads/file/jimikozobunirogunajaj.pdfIn PDF document text
- https://svingenieria.cl/userfiles/file/bijoze.pdfIn PDF document text
- http://dpsszczytno.pl/photo/file/58451465915.pdfIn PDF document text
- https://victory-agency.com/wp-content/plugins/formcraft/file-upload/server/content/files/161eba26138a14---vakezebowigaxabudilowopu.pdfIn PDF document text
- https://ans5680.preneed91.com/upload/files/vovomonazeloro.pdfIn PDF document text
- http://teenmag.cz/userfiles/file/gewojuwibugaravi.pdfIn PDF document text
- http://ever-pioneer.com/upload/files/8006662041.pdfIn PDF document text
- http://kstarsmall.net/userfiles/file///86705831825.pdfIn PDF document text
- https://homeuu.biz/upload/ckeditor/pages/files/3767844036.pdfIn PDF document text
- http://gildiamasterov.ru/userfiles/file/retokilufofalobi.pdfIn PDF document text
- https://riverasphotovideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612b8d92d5771---sarizopepirixapitagumuguw.pdfIn PDF document text
- https://carpanea.it/wp-content/plugins/super-forms/uploads/php/files/b349c69f95cfde9e2f6430c7d793d621/95864652240.pdfIn PDF document text
- http://alrehabourhome.com/userfiles/files/bixubiwiwaladowa.pdfIn PDF document text
- http://cherryontop.pl/upload/fotki/file/tosokumebatiroxumev.pdfIn PDF document text
- http://conservationenergy.com/wp-content/plugins/formcraft/file-upload/server/content/files/161fd6df95f3cb---fikolupibidutoti.pdfIn PDF document text
- http://laxycoffee.com/upload/files/91798067375.pdfIn PDF document text
- http://phuongdonggolf.vn/app/webroot/uploads/files/vegegurikenuwadi.pdfIn PDF document text
- http://polymer-optix.de/userfiles/file/rugiwuwureka.pdfIn PDF document text
- http://www.portofmiamitunnel.com/system/js/back/ckfinder/userfiles/files/94293159432.pdfIn PDF document text
- http://adgroup.co/userfiles/file/bizif.pdfIn PDF document text
- https://associazionemusicaviva.it/uploads/file/xovuf.pdfIn PDF document text
- http://www.bufolari.com/public/immagini/file/15182455565.pdfIn PDF document text
- https://lazeo.nl/userfiles/file/binezobiruxiralalomoki.pdfIn PDF document text
- http://izhar-energy.com/userfiles/file/1133271003.pdfIn PDF document text
- https://verdadeon.com.br/kcfinder/upload/files/56664696207.pdfIn PDF document text
- http://verkaufs-akademie.com/userfiles/file/mugabopidovoletokoratenef.pdfIn PDF document text
- http://www.forexfunction.com/ckeditor/kcfinder/upload/files/fopusejutagagowodameza.pdfIn PDF document text
- http://e-district.org/userfiles/file/miwijeborurumuzubu.pdfIn PDF document text
- http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16203375a52909---90205236027.pdfIn PDF document text
- http://www.mediacomriccione.it/wp-content/plugins/formcraft/file-upload/server/content/files/161a57b1abe191---lizemuraruvinavujusog.pdfIn PDF document text
- http://pusheng168.com/uploadfiles/20211225201351.pdfIn PDF document text
- https://samsungklima.net/upload/ckfinder/files/zovijuxigi.pdfIn PDF document text
- http://najlepsietorty.sk/uploads/fck/file/tugebinapi.pdfIn PDF document text
- http://onthebroadway.com/CPD/adminpanel/upload/file/gewixaxure.pdfIn PDF document text
- http://kingnature.ru/files/files/bapusuvetasobun.pdfIn PDF document text
- https://hearing-outlet.com/uploads/files/202112040420557624.pdfIn PDF document text
- https://sabrinacoiffure.com/userfiles/file/30702538002.pdfIn PDF document text
- https://ichibaninfotech.com/ckfinder/userfiles/files/marosokowirediwasupitetig.pdfIn PDF document text
- http://sipsak.nl/userfiles/file/10457412979.pdfIn PDF document text
- http://zl369.net/userfiles/file/xazejizikedijane.pdfIn PDF document text
- http://inwallendorf.de/userfiles/file/zunetovujutufumepawexegu.pdfIn PDF document text
- http://chnli.tw/CKEdit/upload/files/26208349543.pdfIn PDF document text
- https://rozetki.moscow/kcfinder/upload/files/10365606901.pdfIn PDF document text
- https://www.chinacimctrailer.com/wp-content/plugins/super-forms/uploads/php/files/92757904881aaaa52498d32b38880078/74189584381.pdfIn PDF document text
- http://madmojo.com/fckupload/file/32578965430.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
+6 more URL(s)

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00033cbf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x33CBF	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_01_sfnt_off000353da.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x353DA	18352 bytes
SHA-256: `45b65afefb7edc4b9198444032734bfa98e5dd6c2d55d2835e562867179a3316`
`font_02_sfnt_off000383b0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x383B0	10780 bytes
SHA-256: `1dbd57b666289f36add89384d91b59bf222f34bc46a0edee63bb4840a7e0ca86`
`font_03_sfnt_off00039c78.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x39C78	16220 bytes
SHA-256: `207eb3b51995adbdef2a766e0364e2c2ee182a7f0f0647c12a4a3807efc046f6`

Open this report in the interactive analyzer, or submit your own file for analysis.