Malicious PDF — malware analysis report

Static analysis result for SHA-256 445cc688e4b31021…

MALICIOUS

PDF

198.8 KB Created: 2022-03-12 18:17:19 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-11
MD5: 51519cdb9dbdedb81173e5c3b74f8f3e SHA-1: ccb8a486f0157d09454f9edd25674043459503c2 SHA-256: 445cc688e4b3102175d501b0ac5e500398498897863fbb38824ba2e790e2fa23
166 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7871

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://colod.co.za/XSRYdR1H?utm_term=fedora+server+install+guide PDF link annotation
    • http://progrow-egypt.com/userfiles/file/pufipubunokirorupib.pdfIn PDF document text
    • https://alusol-kw.com/ckfinder/userfiles/files/kovisexezegusizedawajowu.pdfIn PDF document text
    • http://honeystraw.getrade.net/uploadfiles/file/dapirenakodabaxufimate.pdfIn PDF document text
    • http://vln.nl/files/file/xiziw.pdfIn PDF document text
    • https://ost-fogging.com/upload/files/74847858605.pdfIn PDF document text
    • https://dbmotorbrokers.com/userfiles/file/17536177741.pdfIn PDF document text
    • https://escritacontabilidade.net/fotos/news/file/retuturakawelemepifewided.pdfIn PDF document text
    • https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/75ccd4b0f1463f8c820624045417f7d7/74346773533.pdfIn PDF document text
    • http://ergakiland.ru/files/files/wafebiritifepejosatosal.pdfIn PDF document text
    • https://databaze-zdarma.cz/userfiles/files/vewuxilomi.pdfIn PDF document text
    • http://nakakinpump.kr/fckeditor/upload/file/97763130433.pdfIn PDF document text
    • http://fabrykakonwersji.pl/wp-content/plugins/super-forms/uploads/php/files/c74e63af4e6c96c2149956065ed5444a/ludot.pdfIn PDF document text
    • http://goldenagegroup.vip/userfiles/file/kotegakezorexowemutesubu.pdfIn PDF document text
    • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/162032308ca376---64897190697.pdfIn PDF document text
    • http://reelproductionshd.com/userfiles/file/71229962529.pdfIn PDF document text
    • https://1sis.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621024027b933---60490541469.pdfIn PDF document text
    • http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16227a59080e60---32393852555.pdfIn PDF document text
    • http://rebeccafantarchitetto.it/userfiles/files/latulo.pdfIn PDF document text
    • https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1621efb567023e---duzotiminegul.pdfIn PDF document text
    • https://ehilteknik.com/uploads/files/85788995252.pdfIn PDF document text
    • https://asfus.net/virgsurv/userfiles/file/54228701382.pdfIn PDF document text
    • https://n95america.com/wp-content/plugins/super-forms/uploads/php/files/e09a238ac4082aeff46cd75bd5c290d5/sosipamupatiposiseb.pdfIn PDF document text
    • https://ehilteknik.com/uploads/files/sagidu.pdfIn PDF document text
    • http://keemunblacktea.cn/uploads/file/021616331216.pdfIn PDF document text
    • http://www.mkkdigital.pt/wp-content/plugins/formcraft/file-upload/server/content/files/1621371b10b3d1---dilumezumavajon.pdfIn PDF document text
    • https://hotelmitrutarija.com/uploaded/files/94461400969.pdfIn PDF document text
    • http://spellenindex.nl/images/uploads/52391300915.pdfIn PDF document text
    • http://sz-nuoyi.com/Upload/file/2022020415481948920.pdfIn PDF document text
    • http://webyork.co.uk/kcfinder/upload/files/70457214530.pdfIn PDF document text
    • http://besteva.com/upload/files/22194703263.pdfIn PDF document text
    • http://wannawwannie.pl/userfiles/file/39397566851.pdfIn PDF document text
    • http://tauroconsulting.pl/userfiles/file/29760386796.pdfIn PDF document text
    • https://cafemocion.com/userfiles/file/58184565209.pdfIn PDF document text
    • http://www.ortodonciaelisafarache.com/ckfinder/userfiles/files/fokotas.pdfIn PDF document text
    • http://kant21.com/userData/board/file/fukinozofivetelolexajidin.pdfIn PDF document text
    • http://yjeverspeed.com/userfiles/file/1654098502.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002ad44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AD44 10568 bytes
SHA-256: e88e05f70a4fff51a0212c29bb2d613fbbc605885ff36b88bce18e0686693c66
font_01_sfnt_off0002c549.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C549 18200 bytes
SHA-256: b5b05e2593d89b61d3fb06ce31df85b75b9d27cdc98368b391be819c33de7ac4
font_02_sfnt_off0002f4c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F4C2 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9

Open this report in the interactive analyzer, or submit your own file for analysis.