PDF malware analysis — malicious · 4afa889a1bf631f9

MALICIOUS

PDF

474.7 KB Created: 2022-02-07 17:45:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-06

MD5: d4628538b8008f84833ff5c46d8e0341 SHA-1: de098ed5312492704bf831eda481fd3689557155 SHA-256: 4afa889a1bf631f9b96b423fc50cee5314ae263f57f724afc94324f0734c356b

136 Risk Score

Machine Learning

Nyx PDF Classifier suspicious score 0.3225

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yoyep.co.za/XSRYdR1H?utm_term=arjun+reddy+movie++in+tamil PDF link annotation
- http://toyotarent.hk/FileData/ckfinder/files/20211023_3330903EAB2573E0.pdfIn PDF document text
- http://studioindelicato.com/userfiles/files/89846774225.pdfIn PDF document text
- https://villamishkan.com/310renonew/front/images/files/48320806615.pdfIn PDF document text
- https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/156ef18671e4e9a5c32a263de392f5d8/24301860718.pdfIn PDF document text
- https://sibservis.com/ckfinder/userfiles/files/xuzogapewuwikikufuzug.pdfIn PDF document text
- https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/885fb233548e8e0fecdf8fee9933d3a9/3925552794.pdfIn PDF document text
- http://tomaszfilipczak.pl/userfiles/file/zojekem.pdfIn PDF document text
- http://brilsports.ro/userfiles/file///38635602589.pdfIn PDF document text
- http://ros-grad.ru/fck_editor_files/files/texefosevesuborami.pdfIn PDF document text
- http://www.gamylai.vn/uploads/files/2399231671.pdfIn PDF document text
- https://curvy.tw/upload/files/tavijolomofarizinase.pdfIn PDF document text
- http://kbchina.de/upload/poximaxodukaz.pdfIn PDF document text
- http://rayocazar.com/images/elfinder-1.1/files/file/6077941342.pdfIn PDF document text
- http://betheaskssd.com/flash/betheaskssd.com/file/dorekubezelowisumula.pdfIn PDF document text
- https://rakbah.healthybitespk.com/alpha/ckfinder/userfiles/files/modefedekonenivazeves.pdfIn PDF document text
- http://netmutum.com/userfiles/file/23387088106.pdfIn PDF document text
- https://umutisi.com/umut/upload/files/6583963818.pdfIn PDF document text
- http://biblebaptist.kr/user_data/kcfinder/files/jojifivemesapa.pdfIn PDF document text
- http://galettedesrois.hu/userfiles/file/tosap.pdfIn PDF document text
- http://stavo-bazar.cz/userfiles/file/36059650891.pdfIn PDF document text
- http://erfolgsapp.de/wp-content/plugins/formcraft/file-upload/server/content/files/161c7890774f00---vojej.pdfIn PDF document text
- https://koratspring.com/upload/file/pisure.pdfIn PDF document text
- http://senioradviserab.se/admin/kcfinder/upload/files/51404908380.pdfIn PDF document text
- http://buckleyfamilyofdarling.net/clients/0/01/017bf228c8331327bdfb67b1798bff80/File/vuravipatozesujapok.pdfIn PDF document text
- http://studiobardinisrl.com/userfiles/files/22072205659.pdfIn PDF document text
- https://coherence.cz/userfiles/file/89107535927.pdfIn PDF document text
- http://www.drop-lok.com/wp-content/plugins/formcraft/file-upload/server/content/files/16112860234878---jakutubilapujezagalagavar.pdfIn PDF document text
- http://bulk-supplies.com/userfiles/file/77503451136.pdfIn PDF document text
- http://mediaworld.pro/ckfinder/userfiles/files/vupizedevu.pdfIn PDF document text
- http://xn--90aoa5aj.xn--p1ai/ckfinder/userfiles/files/pipagopelina.pdfIn PDF document text
- http://standardamulet.com/files/files/80152948078.pdfIn PDF document text
- https://aldea.work/wp-content/plugins/super-forms/uploads/php/files/c753158cb6cb55e5ffda3b263db51127/gokowixezigo.pdfIn PDF document text
- http://fluitec.fr/ressource/site-image/files/medatinijulifen.pdfIn PDF document text
- http://autavrabek.cz/obrazky/file/vezok.pdfIn PDF document text
- https://himalayanwanderer.com/himalayan/userfiles/files/56587362260.pdfIn PDF document text
- http://www.easemyloan.in/assets/kcfinder/upload/files/gexeraj.pdfIn PDF document text
- http://ediliziaunoaventi.com/userfiles/files/kijimiwujulefozebor.pdfIn PDF document text
- http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/16179e170c4207---gupif.pdfIn PDF document text
- http://velo.hu/UserFiles/file/joxamo.pdfIn PDF document text
- https://torreguitart.cat/fotos/subidas/files/labudobikoko.pdfIn PDF document text
- https://gagiongvitgiong.com/ckfinder/userfiles/files/892328719.pdfIn PDF document text
- https://www.bookings.gulfstarsports.com/admin/kcfinder/upload/files/xukerixopuve.pdfIn PDF document text
- http://babywagen24.de/userfiles/file/32214151161.pdfIn PDF document text
- http://pazarziraat.com/userfiles/file/97173868281.pdfIn PDF document text
- http://eurosolar.cz/res/file/91180444460.pdfIn PDF document text
- http://martonelektro.hu/files/file/56492886789.pdfIn PDF document text
- http://snookerfootball.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16125d56d5e37d---17978562307.pdfIn PDF document text
- http://entryexpress.online/chapter_images/files/biverefefara.pdfIn PDF document text
- http://anhbanglaw.com/userfiles/file/43314156933.pdfIn PDF document text
+8 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0006fa1f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6FA1F	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_01_sfnt_off00071141.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x71141	10632 bytes
SHA-256: `8265f46b31753688f85bce35af10bd066f04a3fe0a3434f3bcff1611e9faf2b9`
`font_02_sfnt_off0007298c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7298C	18216 bytes
SHA-256: `b1b16509160ce7ebce8c7514c7c7c6dc76ecf0cbc05d7ef68bb2df1d0be4492a`

Open this report in the interactive analyzer, or submit your own file for analysis.