Malicious PDF — malware analysis report

Static analysis result for SHA-256 425d05b0709383bc…

MALICIOUS

PDF

249.7 KB Created: 2022-03-20 03:46:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15
MD5: a93ff9a2254af19f1060c85c2d7d1d52 SHA-1: 76f4c26f5742f5c915c9943bafb16c8217493cbe SHA-256: 425d05b0709383bc55c5cfc28e897bf258a98dccee013e20eb09c35c5f12cc06
174 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.5895

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://colod.co.za/XSRYdR1H?utm_term=charter+spectrum+app+on+firestick PDF link annotation
    • http://gelikonline.ru/content/Files/6036924864.pdfIn PDF document text
    • https://dermatologie-francophone.com/userfiles/file/96586894855.pdfIn PDF document text
    • https://doanandieuduong295doson.vn/namthuan/images/news/files/mexovoredit.pdfIn PDF document text
    • http://24x7taazasamachar.com/assets/ckfinder/core/connector/php/uploads/files/51453358184.pdfIn PDF document text
    • https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1620a24b3bfa12---79703898695.pdfIn PDF document text
    • http://jesupraguefilm.cz/pic/files/28751576120.pdfIn PDF document text
    • https://cafesca.info/ckfinder/userfiles/files/jafuwupurexipuwipew.pdfIn PDF document text
    • http://benhvienlaptop.biz/userfiles/file/33937098073.pdfIn PDF document text
    • https://hirurgija.me/files/mexulejimiguk.pdfIn PDF document text
    • https://www.orthomaxindia.net/admin/kcfinder/upload/files/futikuwixovavi.pdfIn PDF document text
    • http://ahkjt.com/upfile/file/93939831288.pdfIn PDF document text
    • http://kidilangues.fr/js/kcfinder/upload/files/vadafoxolaledag.pdfIn PDF document text
    • http://www.psstrecno.sk/wp-content/plugins/formcraft/file-upload/server/content/files/16215948f37861---82287989045.pdfIn PDF document text
    • http://xavitec.com/cliente/conteudos/files/54089482887.pdfIn PDF document text
    • http://catmo.fr/kcfinder/upload/files/14004148073.pdfIn PDF document text
    • http://eigo-manabo.com/app/webroot/js/kcfinder/upload/files/22613445418.pdfIn PDF document text
    • http://asupuro.com/user_data/image/file/geminitilufen.pdfIn PDF document text
    • https://atahca.pt/atahca_gestor/kcfinder/upload/files/94080607078.pdfIn PDF document text
    • http://mdfgiare.com/upload/files/lavamipidukusubekomikis.pdfIn PDF document text
    • https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/kktms3gf26dgsnoihktiipigqh/piwimabakixubejivowe.pdfIn PDF document text
    • http://penzion-u-zamku.cz/files/file/nogejumudonufapixegunuwo.pdfIn PDF document text
    • http://daydeothe.vn/rich_editor/file/lunabukukurakesinek.pdfIn PDF document text
    • https://robvandamfoto.nl/UserFiles/files/niruzefipegavu.pdfIn PDF document text
    • http://xn--80aadq3ae7aa5k.xn--p1ai/upload/file/59818480472.pdfIn PDF document text
    • http://77owship.netsociality.com/upload/files/vifufuja.pdfIn PDF document text
    • https://istanajpdua.com/contents/files/xomifivitazobuwixasikidos.pdfIn PDF document text
    • http://jatyn.cn/upfiles/202203/file/1647734620.pdfIn PDF document text
    • http://montpellier-businessplan.eu/mbp/upload/images/images/upload/ckfinder/fubus.pdfIn PDF document text
    • http://anhuicrew.com/upload_fck/file/2022-3-12/20220312015808228008.pdfIn PDF document text
    • http://siriussiramatik.com/panel/kcfinder/upload/files/58227858289.pdfIn PDF document text
    • http://korio-olsztyn.pl/userfiles/file/44382934509.pdfIn PDF document text
    • http://premiumresourcing.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621620860e9c4---kinede.pdfIn PDF document text
    • https://shibbirs.com/media/files/fodexokokumagenuba.pdfIn PDF document text
    • http://iseveranscopy.com/upload/editor/file/53859100175.pdfIn PDF document text
    • https://vigilanciaweb.cl/dinamicos/files/file/lezal.pdfIn PDF document text
    • https://sskundal.com/userfiles/file/24948316873.pdfIn PDF document text
    • https://rugsdirect4u.com/uploadedfiles/file/45981016598.pdfIn PDF document text
    • https://nppgursaraijhansi.in/ckfinder/userfiles/files/33815950895.pdfIn PDF document text
    • https://vntdc.com/upload/fck/file/13060171561.pdfIn PDF document text
    • https://rasathantrananotech.com/ckfinder/userfiles/files/lemumi.pdfIn PDF document text
    • https://www.supergram.cz/kcfinder/upload/files/85444871978.pdfIn PDF document text
    • https://protraderin.com/userfiles/file/sekuxokexuzalejavo.pdfIn PDF document text
    • https://ceb.lk/assets/js/kcfinder/upload/files/febamibijafinotugagele.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    +2 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0003727d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3727D 19600 bytes
SHA-256: c2cce794fd0f07675ad851f2aed36cd882edde7f71b39b7c91304c59e2f95c2d
font_01_sfnt_off0003a5c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3A5C5 10924 bytes
SHA-256: b2f2a375f79c9fd562e52580b5ffeabe2dda63e181eb3041d716fccf7c7567a5
font_02_sfnt_off0003bef4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BEF4 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9

Open this report in the interactive analyzer, or submit your own file for analysis.