PDF malware analysis — malicious · 445fedf428d1a820

MALICIOUS

PDF

586.3 KB Created: 2022-03-08 20:22:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-10

MD5: 3761f2f42e442987fae6e42cfb7e3569 SHA-1: eeeb662a0a9f8a51db438018a7a2f123fc993ea1 SHA-256: 445fedf428d1a820f2ea433fbba0dbed0e7d03e607408c717b58815473a83555

144 Risk Score

Machine Learning

Nyx PDF Classifier clean score 0.2252

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yubit.co.za/XSRYdR1H?utm_term=marvel+avengers+3d+wallpaper PDF link annotation
- http://www.plavanikojencupraha.cz/upload/files/wixirifajigumapepalis.pdfIn PDF document text
- http://mestan.by/images/file/bimunugoradawejewituzipu.pdfIn PDF document text
- http://kickstartfintech.com/ckeditor/kcfinder/upload/files/tesibitizodulesetavenap.pdfIn PDF document text
- https://pointvirgule.ca/upload/editor/file/88238106560.pdfIn PDF document text
- http://elmasryeverline.net/public/kcfinder/upload/files/xelalosidumelazajokevo.pdfIn PDF document text
- http://oa30us.com/userfiles/file/3943974856.pdfIn PDF document text
- https://kvgrup.com.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16213fb0257e6d---votixikat.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/161f89780aa4f2---79914867089.pdfIn PDF document text
- https://kvgrup.com.ua/wp-content/plugins/formcraft/file-upload/server/content/files/16204d0a97dbbf---xexaliluxiride.pdfIn PDF document text
- http://diamantina-joaillerie.com/ckfinder/userfiles/files/77766814749.pdfIn PDF document text
- http://blackivy.pl/userfiles/file/xubexotufinezupe.pdfIn PDF document text
- http://lingotranssgg.lingotrans.com/fck/file/40599316487.pdfIn PDF document text
- http://albertf.madteam.net/ckfinder/userfiles/files/rudetidugadokawegezelido.pdfIn PDF document text
- http://piazzademarini3ge.com/userfiles/files/15820627372.pdfIn PDF document text
- http://wxmx.cn/upload/ckimg/files/202202282253581425.pdfIn PDF document text
- https://iwanbim.com/userfiles/files/xamenobodolukekasona.pdfIn PDF document text
- http://chanakol.com/ckfinder/userfiles/files/77930848580.pdfIn PDF document text
- https://schneider-rozetki.su/kcfinder/upload/files/13312689247.pdfIn PDF document text
- http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/16213d3a606e25---60732997455.pdfIn PDF document text
- http://abc-tel.ru/data/File/keroripubelozixedit.pdfIn PDF document text
- https://illinoisfiscalpolicycouncil.org/app/webroot/userfiles/file/33785131512.pdfIn PDF document text
- https://cafemocion.com/userfiles/file/tukotipidijuxababegivof.pdfIn PDF document text
- http://www.bufolari.com/public/immagini/file/78721117404.pdfIn PDF document text
- http://kamerton.nl/clientfiles/27798310735.pdfIn PDF document text
- https://cdmsig.com/ckfinder/userfiles/files/nibexire.pdfIn PDF document text
- https://momsgardenfoods.com/ckfinder/userfiles/files/19920705841.pdfIn PDF document text
- http://coopaac.com/assets/kcfinder/upload/files/43801956085.pdfIn PDF document text
- http://sun-eko.eu/files/file/68161036547.pdfIn PDF document text
- https://1snrpaulista.com.br/ckfinder/userfiles/files/32204296320.pdfIn PDF document text
- http://eko-uklid.com/files/file/50772450193.pdfIn PDF document text
- http://berchmanskuwait.org/uploads/file/62305865794.pdfIn PDF document text
- http://altinay-law.com/images/file/65790446199.pdfIn PDF document text
- http://iuppiteredizioni.it/kcfinder/upload/files/80991901729.pdfIn PDF document text
- https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/jqkurh5eeklf2807qkq92mf7ge/7768988702.pdfIn PDF document text
- http://www.kermaz.fr/js/kcfinder/upload/files/wiledupikofedepotires.pdfIn PDF document text
- http://el-system.jp/uploads/2012/files/77651176531.pdfIn PDF document text
- http://cmtl.in/uploads/userfiles/file/file/sajisotifegutoma.pdfIn PDF document text
- http://plncse.hu/php_data/file/wuligozufosalepuwuvo.pdfIn PDF document text
- https://rozetki.moscow/kcfinder/upload/files/sadatixasolakumokunit.pdfIn PDF document text
- https://tuyothuyluc.vn/webroot/img/files/30104355048.pdfIn PDF document text
- http://ues-rb.ru/themes/ues-rb.ru/files/limamefi.pdfIn PDF document text
- http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/162270a8b3db7f---61492440358.pdfIn PDF document text
- http://friend5190.xyz/js/ckfinder/userfiles/files/sojuguzomegenodemun.pdfIn PDF document text
- https://www.budgetskemaet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1621104bda069a---goxusowepifidabijogapa.pdfIn PDF document text
- http://birizgardenhotel.com/userfiles/file/1537857591.pdfIn PDF document text
- http://kayseritupbebektedavisi.com/angora/userfiles/file/xilatolizuzuxaxere.pdfIn PDF document text
- http://fuchs-orthopaedie.de/UserFiles/file/faninipabonilo.pdfIn PDF document text
- http://philippetardieu.com/kcfinder/upload/files/bofizuzad.pdfIn PDF document text
- https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621dcf7381a20---93519513858.pdfIn PDF document text
+12 more URL(s)

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0008a88f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A88F	10572 bytes
SHA-256: `92774a28cf0a98390ddf12a061ce44f4edce1f9efc384dfcf23f7602ec3b002d`
`font_01_sfnt_off0008c0bb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8C0BB	20660 bytes
SHA-256: `499086442739efade230129ff6d410478548f02cff0217ad438d32c1a75aff42`
`font_02_sfnt_off0008f678.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F678	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_03_sfnt_off00090d9a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x90D9A	1696 bytes
SHA-256: `28c5bcedffb0f63c0f18ed07264126f7c833899b916de9a351f9850be7cb6bae`

Open this report in the interactive analyzer, or submit your own file for analysis.