PDF malware analysis — malicious · 4af01c7f3e954306

MALICIOUS

PDF

411.2 KB Created: 2022-04-28 00:53:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-06

MD5: 09ff06951e73fc3e3311d942a886d850 SHA-1: 3cdcc00eeedca58805c24ce91fe40aa3e4079bfc SHA-256: 4af01c7f3e954306de620e374d0fe09d9cf216b0b34857d1ff6ba9ce9681a53e

166 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.5194

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://sunuf.co.za/XSRYdR1H?utm_term=bill+of+lading+form+for+ups+freight PDF link annotation
- https://pevaluxuduta.weebly.com/uploads/1/3/4/5/134502983/zaloj.pdfIn PDF document text
- http://aktifimmo.lu/userfiles/files/94839056121.pdfIn PDF document text
- https://fokomilek.weebly.com/uploads/1/3/4/8/134849947/4584c9f.pdfIn PDF document text
- http://www.littlebookofjohn.com/kcfinder/upload/files/votajizedamikukef.pdfIn PDF document text
- https://sweetestspaparty.com/wp-content/plugins/formcraft/file-upload/server/content/files/162151b18060c8---kuwibezifuzujikipotuv.pdfIn PDF document text
- https://sf-tfi-pgu.uz/wp-content/plugins/super-forms/uploads/php/files/2573b68eda53796f477bffae0eb5f614/wokafimikero.pdfIn PDF document text
- https://comillaspostgrado.es/userfiles/file/mukapewavirabosewogegeze.pdfIn PDF document text
- http://sb-78.ru/files/file/rizutivokodewosasa.pdfIn PDF document text
- https://nceptionsolutions.com/wp-content/plugins/super-forms/uploads/php/files/26c467b65022220b3a55ef49d3142d7f/38105087294.pdfIn PDF document text
- http://villapastello.com/admin/data/files/files/kebogigodanawexuwepugu.pdfIn PDF document text
- http://darangyi.com/userData/board/file/munixa.pdfIn PDF document text
- https://vutolevufitev.weebly.com/uploads/1/4/1/3/141363437/b039294ed7f2d.pdfIn PDF document text
- https://cafesca.mx/ckfinder/userfiles/files/88251045876.pdfIn PDF document text
- https://jajamavufivaz.weebly.com/uploads/1/3/4/2/134235884/2124216.pdfIn PDF document text
- https://nodekisoguzila.weebly.com/uploads/1/3/5/3/135313862/960857.pdfIn PDF document text
- https://xisudujerixaxir.weebly.com/uploads/1/3/4/5/134583325/rulumomum_vagorufibugako_bagogo_nijes.pdfIn PDF document text
- https://investin-khj.ir/ckfinder/userfiles/files/nalajix.pdfIn PDF document text
- http://flygarfield.net/userfiles/file/lenowep.pdfIn PDF document text
- http://attilacenter.org/userfiles/file/9357678754.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622342882ea36---66730839601.pdfIn PDF document text
- https://makojinoguj.weebly.com/uploads/1/3/1/4/131406607/figamoxosin-xetit-legutonux-lepizir.pdfIn PDF document text
- http://lynxauto.ru/userfiles/file/kinifozexusadufoseju.pdfIn PDF document text
- http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16265bb040ae4d---52351003843.pdfIn PDF document text
- http://slovoveri.org/userfiles/93428375887.pdfIn PDF document text
- https://www.oceaniacroisieres.com/html/scripts/ckeditor/kcfinder/upload/files/tizatukezurubabugow.pdfIn PDF document text
- https://xitarowax.weebly.com/uploads/1/3/2/6/132681505/kibejejilaw.pdfIn PDF document text
- https://drlalashow.com/php/billboard/uploads/file/70691887718.pdfIn PDF document text
- http://luchetti.it/userfiles/files/vulupoweromodabenoba.pdfIn PDF document text
- https://matauco.com/sites/default/files/uploads/file/26404209935.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/162389821c57fd---16425060357.pdfIn PDF document text
- https://gosikemimikivum.weebly.com/uploads/1/3/4/6/134674661/4909525.pdfIn PDF document text
- https://wijizavop.weebly.com/uploads/1/3/4/3/134309393/guzadusuzonujupu.pdfIn PDF document text
- http://superazs.ru/images/news/file/44487480028.pdfIn PDF document text
- https://pazovazorukilaz.weebly.com/uploads/1/3/4/6/134673506/b6521086fe2b12.pdfIn PDF document text
- http://babyindex.nl/images/uploads/98756263632.pdfIn PDF document text
- http://tamezou.com/upload/ckfinder/files/pimedadaneselotavilo.pdfIn PDF document text
- https://www.jornaloflorense.com.br/admin/ckeditor/kcfinder/upload/files/19556579623.pdfIn PDF document text
- http://liluby.com/upload/file/resatujidebemu.pdfIn PDF document text
- https://sarixibaparuve.weebly.com/uploads/1/3/4/3/134382026/3446149.pdfIn PDF document text
- http://mppscstudy.com/admin/usercontent/file/84006016709.pdfIn PDF document text
- https://jikudirag.weebly.com/uploads/1/3/4/0/134040407/3636e23001.pdfIn PDF document text
- https://bwhe.in/ckfinder/userfiles/files/famonekiwe.pdfIn PDF document text
- http://vcelari.naceradec.cz/includes/ckfinder/userfiles/files/86988605935.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
+2 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0005fba4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FBA4	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off000613bb.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x613BB	11096 bytes
SHA-256: `ae9d21d872ebf3cffcc9122499da5a1e97b7501f59a10bda0b84b2e64fd08b0a`
`font_02_sfnt_off00062d32.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62D32	18252 bytes
SHA-256: `8a4d57a6df326f625e5786b422374f67d76200c3de43351d5207e46e6b253b8a`

Open this report in the interactive analyzer, or submit your own file for analysis.