PDF malware analysis — malicious · 4e3b1436d4a19710

MALICIOUS

PDF

92.9 KB Created: 2021-09-13 11:02:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-19

MD5: 9e63727bc6675f1b8d1a41ec9945ba14 SHA-1: a80bb4b74de3535a014779de2a062ade63d69895 SHA-256: 4e3b1436d4a19710958f835639a07eca648da922246a036c68076cc45459abae

156 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9982

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://bangladeshceramicsociety.com/uploads/editor/files/94378409974.pdf In PDF document text
- http://umrllc.com/userfiles/files/xitajuveburabubezites.pdfIn PDF document text
- https://bomberosdenavarra.com/userfiles_nexo/files/kopilemebirula.pdfIn PDF document text
- https://pavaniautismschools.com/wp-content/plugins/super-forms/uploads/php/files/dajs7d87qsft03v7j5o34rp44s/27680219867.pdfIn PDF document text
- https://lesura.net/userfiles/file/93997856404.pdfIn PDF document text
- https://northcoteplaza.com/userfiles/file/fejamon.pdfIn PDF document text
- https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/2f25a066fc10eadfe16bb507a434382d/pawubitisigeposijefex.pdfIn PDF document text
- http://photopuzzle.net/userData/board/file/6885822860.pdfIn PDF document text
- http://www.fsnn.se/wp-content/plugins/formcraft/file-upload/server/content/files/1612f776d30e9b---82052723548.pdfIn PDF document text
- https://leonardscopysystems.com/home/leonards/public_html/ckfinder/userfiles/files/78732083961.pdfIn PDF document text
- http://suncitygroup.ir/basefile/suncitygroupir/files/bomoxesidagow.pdfIn PDF document text
- https://www.koreayokogawa.com/ckfinder/userfiles/files/16536608753.pdfIn PDF document text
- https://euinsuti.uniluxgym.ro/app/webroot/files/userfiles/files/fozuzapezatateze.pdfIn PDF document text
- http://kfnmsz.com/upfolder/e/files/20210901132244.pdfIn PDF document text
- http://bowenlawmt.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/voxusodoposabotevege.pdfIn PDF document text
- http://gonganmi.com/userfiles/file/29222821138.pdfIn PDF document text
- https://millvalley.com/wysiwygfiles/file/zibuwabakus.pdfIn PDF document text
- http://munnarteabungalows.com/userfiles/file/71313933609.pdfIn PDF document text
- http://avtokit116.ru/!upload/files/52479507875.pdfIn PDF document text
- http://studiogeologicotrilobite.com/userfiles/files/27476817281.pdfIn PDF document text
- https://esperidiaogomes.com/userfiles/files/83461201433.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=seg+clip+mobile+androidPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000104f5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x104F5	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_01_sfnt_off00011d0c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11D0C	10808 bytes
SHA-256: `60afd4b228a7a539bc4f8384d864357978a9c5e8bbec91445c85c02adf92dc69`
`font_02_sfnt_off0001356e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1356E	18588 bytes
SHA-256: `f52a45da3af6343e85eb512be91e25d1c8f272101722384d2dedf291fb471054`

Open this report in the interactive analyzer, or submit your own file for analysis.