PDF malware analysis — malicious · 445e20527e73609c

MALICIOUS

PDF

420.7 KB Created: 2022-03-04 11:00:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-11

MD5: 8c071b15fd9232c0b5b6fe1b093bf69f SHA-1: 510ce52100496d160ccc07c011268c26e48c4c93 SHA-256: 445e20527e73609cc8bc0155fbbfb6a134c534206cc4459056f9a6216edfd287

136 Risk Score

Machine Learning

Nyx PDF Classifier suspicious score 0.4050

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://lovig.co.za/XSRYdR1H?utm_term=area+of+a+sector+word+problems+worksheet PDF link annotation
- http://svm.kalistecom.org/img/files/sizononevase.pdfIn PDF document text
- https://stotex.rs/files/55523090977.pdfIn PDF document text
- http://lechioutdoor.com/userfiles/file/mumoluwijufajiziluvon.pdfIn PDF document text
- http://www.ztc.hekko24.pl/panel/kcfinder/upload/files/lasimodoxixomumikutuzikaj.pdfIn PDF document text
- https://www.smartfutureexpo.com/ckfinder/userfiles/files/8475428851.pdfIn PDF document text
- http://bionic-hill.com/resources/files/xizixexoriw.pdfIn PDF document text
- http://journalstudiesanthropology.ro/adm/jsq/kcfinder/upload/files/tawuridasapisumuzarelepid.pdfIn PDF document text
- https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/c7277590e13456782bb964ab2970a34f/kegepexebozedeleluj.pdfIn PDF document text
- http://lsneotek.com/ckupload/files/607109256.pdfIn PDF document text
- https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/16216b9b5a59f3---87105085385.pdfIn PDF document text
- https://consurs.ro/ckfinder/userfiles/files/faper.pdfIn PDF document text
- http://www.cheapmotorcycleinsurancepa.com/wp-content/plugins/super-forms/uploads/php/files/feb2caff3a7b73ab89e36208d7ab82c6/47996099728.pdfIn PDF document text
- https://www.akita-tourism.com/assets/admin/plugins/kcfinder/files/basajebozeguxi.pdfIn PDF document text
- http://dreamcatcherltd.com/userfiles/file/15684835944.pdfIn PDF document text
- http://byty-pardubice.eu/UserFiles/File/sibakaxex.pdfIn PDF document text
- https://dacinsara.ro/fckfiles/file/87176713723.pdfIn PDF document text
- http://www.chinnanaidoo.org.za/kcfinder/upload/files/sobekevazanegudigid.pdfIn PDF document text
- https://hatarozatok.martonvasar.hu/ckeditor/kcfinder/upload/files/33233224632.pdfIn PDF document text
- https://www.misuhuko.com/assets/kcfinder/upload/files/59961052171.pdfIn PDF document text
- http://csm-membrans.ru/app/webroot/upload/files/litunekadifidozotuxar.pdfIn PDF document text
- http://schwierzy.pl/uploads/files/pazeguruk.pdfIn PDF document text
- http://azizavacanze.com/userfiles/files/64447334229.pdfIn PDF document text
- https://vhssirimpanam.org/ckfinder/userfiles/files/wazelunobuwenolunotub.pdfIn PDF document text
- https://transport.frontiermyanmar.com/sites/all/libraries/ckfinder/userfiles/files/61978592402.pdfIn PDF document text
- http://vietdubai.com/userfiles/file/pizejosux.pdfIn PDF document text
- http://www.norestim.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16217108bde7fc---nusarigulazexixupobafami.pdfIn PDF document text
- https://www.misuhuko.com/assets/kcfinder/upload/files/52936627791.pdfIn PDF document text
- http://mwflower.com/upimagesfile///43996148769.pdfIn PDF document text
- https://coil.hk/upload/files/munitoburozinax.pdfIn PDF document text
- http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16205f3460d17c---morezolironal.pdfIn PDF document text
- http://flexinform.com/hirlevel/file/fusuxeworaxatisop.pdfIn PDF document text
- https://zivotzaokny.eu/res/file/suzojuroketuwutejajazorev.pdfIn PDF document text
- https://nergizleryapi.com/image/files/rejibatizilosi.pdfIn PDF document text
- http://eviljoy.com/UserFiles/File/fizapaj.pdfIn PDF document text
- https://812423.situshoki1.com/contents/files/sidisokufafalume.pdfIn PDF document text
- http://niktid.ru/userfiles/file/8105893133.pdfIn PDF document text
- https://soechi.com/userfiles/file/votira.pdfIn PDF document text
- http://lovebridal.moscowfashion.net/content/xuploadimages/file/44027092360.pdfIn PDF document text
- https://gauravkankariya.com/wp-content/plugins/super-forms/uploads/php/files/9d08755de49ccb8ab27005cc530a1e2c/33265184896.pdfIn PDF document text
- http://scenekunstskolen-efteruddannelsen.dk/ckfinder/userfiles/files/toxolixiwufumodirinufol.pdfIn PDF document text
- http://groupunsur1.com/contents/files/39448157407.pdfIn PDF document text
- http://aktasmatbaacilik.com/resimlerfiles/74073341196.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
+1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00061ba3.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61BA3	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_01_sfnt_off000632be.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x632BE	19860 bytes
SHA-256: `1e41dab806eaa0962da1ac1831ea07ea6b988f0657de427987e266c0874f7ed4`
`font_02_sfnt_off0006672c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6672C	10988 bytes
SHA-256: `dda739b162f16588b57f6159bfe268030a92d1769e2b51561ad14e22a318f7c8`

Open this report in the interactive analyzer, or submit your own file for analysis.