PDF malware analysis — malicious · 43b3ce96b83b207c

MALICIOUS

PDF

81.7 KB Created: 2021-06-28 07:51:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05

MD5: dbaf153ebb0931af89fa5d37153f5c62 SHA-1: 56a1fd6e415d2fdfd0a16bdd3c683aeee1a8f3ab SHA-256: 43b3ce96b83b207cac21e07c57c2e48230d7a5dee80bdeee0bc4bbf66f42cfdb

156 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised WordPress upload directories and other potentially malicious sites, suggesting it functions as a lure to redirect users to harmful content. The presence of external URIs and link farms on disposable hosting further supports its role in a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier malicious score 0.9833

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://catamma.ru/uplcv?utm_term=let+it+cover+me+up+lydia PDF link annotation
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609a8f5b91dea---45042061748.pdfIn PDF document text
- https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16094434ead07d---40779831381.pdfIn PDF document text
- http://brilspa.ro/userfiles/file///kamufe.pdfIn PDF document text
- https://www.golaw.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b3cd13275cf---nixuxipupixowisejejijowi.pdfIn PDF document text
- http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/160c8de819dac0---12268204626.pdfIn PDF document text
- http://jandebruijn.com/uploadimages/files/zadexogokovoladiwex.pdfIn PDF document text
- http://studiolegaletrotta.eu/userfiles/files/44522730506.pdfIn PDF document text
- http://ebiocell.com/uploadfile/file///2021061902590732.pdfIn PDF document text
- http://anandamsanyal.com/userfiles/file/28407215004.pdfIn PDF document text
- http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607863d832851---2187269386.pdfIn PDF document text
- https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/rs0atn9ugo9utrdmdueifkpb44/89970264829.pdfIn PDF document text
- https://rjiminfra.com/wp-content/plugins/super-forms/uploads/php/files/521c36d0ad9c2bbdd831e8654944a071/41601686413.pdfIn PDF document text
- http://stellamaris.cz/userfiles/10674132860.pdfIn PDF document text
- http://nawooelcs.com/upload/userfiles/2021/06/files/210628075637.pdfIn PDF document text
- https://siphouse96.com/wp-content/plugins/super-forms/uploads/php/files/f2caf0eaaac554c5b8041905174fd5c6/94861929894.pdfIn PDF document text
- https://www.hontoys.com.au/wp-content/plugins/super-forms/uploads/php/files/bcus3rftf3katfdkhb88geh5it/79450192049.pdfIn PDF document text
- https://www.inkfactory.pk/wp-content/plugins/formcraft/file-upload/server/content/files/16082264f4b43c---puzaz.pdfIn PDF document text
- http://pvsystreports.com/wp-content/plugins/super-forms/uploads/php/files/h9e448gmbuus1pu4skvisf1813/xuligapuwirukutuwuba.pdfIn PDF document text
- http://accessiblevehicleservices.com/userfiles/file/62889193758.pdfIn PDF document text
- http://imaginove.eu/data/Files/mataf.pdfIn PDF document text
- https://www.ferienhof-schneider.de/wp-content/plugins/formcraft/file-upload/server/content/files/16083fe8126c2d---mebivemapufiwux.pdfIn PDF document text
- http://imagespa.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160780e501de63---kukafivetewugawegu.pdfIn PDF document text
- https://circolodelpistone.ch/userfiles/file/42966142680.pdfIn PDF document text
- http://lalitas-thaimassage-spa.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a613e7166ad---sisori.pdfIn PDF document text
- https://glosunspa.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087652d9e734---6729883303.pdfIn PDF document text
- https://arizonalightingsales.com/wp-content/plugins/super-forms/uploads/php/files/fa3fc4ac7b8c84ef85693a565d26a11b/giwulepapomajo.pdfIn PDF document text
- http://www.leesii.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a39f22b42d7---rugodasesavifisufi.pdfIn PDF document text
- https://bxthirteen.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/855ddf8307a388e883be34dcfbd6a25b/14429449195.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dc37.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDC37	10640 bytes
SHA-256: `fa27a978b54148200b1e411d96b3c72e5d34033cc6da0816a4c6fec602117f58`
`font_01_sfnt_off0000f49c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF49C	17000 bytes
SHA-256: `82f3bc339bbc9a7fe2e56cfa9daf3bb6d932f6c5a026ac9d9573a7d8096b1ae7`
`font_02_sfnt_off00012132.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12132	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`

Open this report in the interactive analyzer, or submit your own file for analysis.