Malicious PDF — malware analysis report

Static analysis result for SHA-256 478b3ea4c8f4d1e5…

MALICIOUS

PDF

416.2 KB Created: 2022-01-22 05:34:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-20
MD5: c63997b5907ad52aa43a3e73e605d2d8 SHA-1: e653f4658a7f4e4fc69f8007baa05aec6e592722 SHA-256: 478b3ea4c8f4d1e55cfe592235e9ec9d4076472e8ea3cb60be5f2dedfc1f58ba
144 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.4079

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fisioterapiasuzzara.it/userfiles/files/dumodowapikuvawezesu.pdf In PDF document text
    • http://thermcom.cz/userfiles/file/kaxukekome.pdfIn PDF document text
    • http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/161e3d13cbac24---84426525282.pdfIn PDF document text
    • https://hoya.hr/UserFiles/file/maxafosejaxumaxopo.pdfIn PDF document text
    • http://opt-russtd.ru/data_center/upload_pictures/file/23783640426.pdfIn PDF document text
    • http://honeystraw.com/uploadfiles/file/gojujaxagenuno.pdfIn PDF document text
    • http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16155787fb6ec0---funulekiwavuzaweguvuwufa.pdfIn PDF document text
    • http://cheniou.handysociality.com/upload/files/jeledirifabuxazipekivozav.pdfIn PDF document text
    • http://kanchanaspa.com/ckfinder/userfiles/files/66531589580.pdfIn PDF document text
    • http://www.naturhalles.fr/fckeditor/userfiles/file/kamekofi.pdfIn PDF document text
    • https://ssmahavidyalaya.org/lion/uploadedfiles/fck/files/file/bitasamatasilafoxaxuk.pdfIn PDF document text
    • https://orangerun.re/photo/files/46401284340.pdfIn PDF document text
    • https://khachsan295doson.vn/namthuan/images/news/files/tivipevesovadel.pdfIn PDF document text
    • http://cdkkck.com/uploadfile/file/20210906202152.pdfIn PDF document text
    • http://montagnobozzone.it/userfiles/files/pevukiwuxikelex.pdfIn PDF document text
    • http://wxdyzs.com/userfiles/files/74656517729.pdfIn PDF document text
    • http://phuongsen.com/img-chamthi/files/numikekopafomibek.pdfIn PDF document text
    • https://www.larche-de-jules.fr/ckfinder/userfiles/files/79856384572.pdfIn PDF document text
    • http://plenerowe.kbo.pl/ckfinder/userfiles/files/zebademudizovagasiwanemux.pdfIn PDF document text
    • https://argumentua.com/i/file/tanojiwilasi.pdfIn PDF document text
    • https://drlalashow.com/php/billboard/uploads/file/33624121860.pdfIn PDF document text
    • https://www.chinacimctrailer.com/wp-content/plugins/super-forms/uploads/php/files/5789133605491c2694349d107c8aa621/50089609833.pdfIn PDF document text
    • https://begili.com/uploads/image/files/xosokapa.pdfIn PDF document text
    • https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/c44a107c3276347fdfd8915231d54a00/82824291796.pdfIn PDF document text
    • http://neurooperations.com/ckfinder/userfiles/files/pavubimexadamekadodawuwol.pdfIn PDF document text
    • https://magicdiscoradio.hu/userfiles/file/40179585047.pdfIn PDF document text
    • https://otoform.com/upload/ckfinder/files/67131362543.pdfIn PDF document text
    • http://yokohamashiki-m.jp/app/webroot/js/kcfinder/upload/files/37646206021.pdfIn PDF document text
    • https://khabul.mn/mmpa/userfiles/files/fonarizor.pdfIn PDF document text
    • http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613c1c9040810---17468394156.pdfIn PDF document text
    • http://skkouty.cz/ckfinder/userfiles/files/xolixonolanorigu.pdfIn PDF document text
    • http://harryreichert.de/uploaded_pics/News/file/80045578206.pdfIn PDF document text
    • http://sarahscupcakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1617409dd3afe0---65779571401.pdfIn PDF document text
    • http://ameshamagazine.com/js/upload/files/wuzinamuzorimixebijixojog.pdfIn PDF document text
    • http://www.kzhep.in.ua/wp-content/plugins/super-forms/uploads/php/files/h9h6ov1fof84b5de944ino4ss3/lexutamegamelogalimekav.pdfIn PDF document text
    • https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/952b93d0825852a22637acb8395ca755/82433096974.pdfIn PDF document text
    • http://furasskutat.hu/admin/kcfinder/upload/files/liduloleluvuvepikofali.pdfIn PDF document text
    • http://safaraval.com/basefile/safaravalcom/files/pesimojivupexedakijovetex.pdfIn PDF document text
    • http://feedproxy.google.com/~r/Xvkpad/~3/4dZi1sgP-vI/uplcv?utm_term=bhojpuri+video+hd+gane+song+freePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netReferenced by PDF JavaScript
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseReferenced by PDF JavaScript

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000615bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x615BF 16652 bytes
SHA-256: 5905ea331efe64fabca3ffc5cacca96cb5b22a5d0da9a6fee02612327c6b4726
font_01_sfnt_off00064116.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64116 10984 bytes
SHA-256: 1800cd84b823bdb3fdae5a3c500e2371dbadf4971171157c9cd83c50edec7f28
font_02_sfnt_off00065a4d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65A4D 16416 bytes
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336

Open this report in the interactive analyzer, or submit your own file for analysis.