PDF malware analysis — malicious · 4e3b88ec12dbf7b1

MALICIOUS

PDF

410.6 KB Created: 2022-02-07 00:10:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-19

MD5: 81f7c1ea636330d763b73db26d752f53 SHA-1: 36d9e17a87563083e19b006518b7bd70c601f0d2 SHA-256: 4e3b88ec12dbf7b110c6b839be44bf9d054e602c3677033e79bebc3d7b277bd6

136 Risk Score

Machine Learning

Nyx PDF Classifier suspicious score 0.3603

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yubit.co.za/XSRYdR1H?utm_term=bagan+keyboard+apk+all+version PDF link annotation
- https://beautifulhairstore.com/upload/files/85896774013.pdfIn PDF document text
- http://honeycontacts.com/uploades/userfiles/file/67115350968.pdfIn PDF document text
- http://simpelms.nl/userfiles/files/dapamuw.pdfIn PDF document text
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/161c79fc3ef4db---21959884039.pdfIn PDF document text
- http://citygclub.com/ckupload/files/tasabenuradajipofesipet.pdfIn PDF document text
- http://tktravel.shop/FileData/ckfinder/files/20210702_079B88193D2D734D.pdfIn PDF document text
- https://totounited.com/contents/files/tuver.pdfIn PDF document text
- https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/4b3c7a03771929ea9796ee1c7ce832b5/70028689400.pdfIn PDF document text
- https://www.infratechgroep.nl/wp-content/plugins/super-forms/uploads/php/files/4a02b941e40885a52e3d0f2a23815298/33955663015.pdfIn PDF document text
- http://ucity68.com/clients/e/ea/ea220da86df44fb0ae3b7c8e8295ccc1/File/83146352346.pdfIn PDF document text
- https://granitabrasive.com/editor_up/zizetixajimazaweposidaf.pdfIn PDF document text
- http://bajajsports.com/userfiles/file/jojovugobuketiko.pdfIn PDF document text
- http://dejonghenico.be/sites/default/files/file/pudusinedalepo.pdfIn PDF document text
- https://www.traitagri-solutions-alternatives.fr/ckfinder/userfiles/files/zufuxotakawigutodezefam.pdfIn PDF document text
- http://hotelbellevuepalermo.com/userfiles/files/84684046157.pdfIn PDF document text
- http://mlgholding.hu/admin/kcfinder/upload/files/lumujitojo.pdfIn PDF document text
- https://beldapromosyon.com/calisma2/files/uploads/13822806277.pdfIn PDF document text
- http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/161cd75aa4cde1---liruwivawakiwutebik.pdfIn PDF document text
- https://hsiaoying.com/userfiles/file/33912491734.pdfIn PDF document text
- http://lighthouse-connection.at/myPix/file/wavomudolupoboxejawofuri.pdfIn PDF document text
- http://pescepiana.eu/userfiles/files/lanilez.pdfIn PDF document text
- https://mundolibre.cl/uploads/userfiles/files/21131279486.pdfIn PDF document text
- http://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/950fc11fc34c2d7f89850dbf8c5e7ea1/86379387545.pdfIn PDF document text
- https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/pppikgc4oh8d838aef3d73bi44/garubagubomekotase.pdfIn PDF document text
- http://galenbio.com/images/upload/file/47186261826.pdfIn PDF document text
- https://cicasoftavukatwebsitesi.demowebsiteleri.com/upload/files/4012655871.pdfIn PDF document text
- https://hopadive.cz/ckfinder/userfiles/files/walaxililowujawos.pdfIn PDF document text
- https://dangeloremodeling.com/nbloom/fckuploads/file/xuxezepizazilipepitatox.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/161252041120d4---77596553779.pdfIn PDF document text
- http://usaoxin.com/userfiles/2021-9/file/70709764454.pdfIn PDF document text
- http://banderlogclub.ru/kcfinder/upload/files/14585013710.pdfIn PDF document text
- http://aquatherm-graz.at/files/69250732497.pdfIn PDF document text
- http://aeronautike.com/userfiles/file/ladosekipejorativopikotif.pdfIn PDF document text
- http://georgewongdesign.com/gwd/upload/files/50034553599.pdfIn PDF document text
- http://eviljoy.com/UserFiles/File/sosuzemuritifagakeret.pdfIn PDF document text
- http://xutricolor.com/uploadfile/files/ramorudo.pdfIn PDF document text
- http://futurepoolandspa.com/ckfinder/userfiles/files/jufiwepatumajotekujat.pdfIn PDF document text
- https://candica.pl/ckfinder/userfiles/files/rujadugesepami.pdfIn PDF document text
- http://manchesternh298.org/kcfinder/upload/files/juzejavitugowokebibuzagow.pdfIn PDF document text
- http://silarperu.com/UserFiles/file/52550328336.pdfIn PDF document text
- http://patroha.hu/file/malebawupulirokumifu.pdfIn PDF document text
- http://nacyc.jp/Upload/file/55081182348.pdfIn PDF document text
- https://www.asoriofrio.org/ckfinder/userfiles/files/nepipafuwexir.pdfIn PDF document text
- http://mayjack.com/upload/files/54041296846.pdfIn PDF document text
- https://siemens-rozetki.ru/kcfinder/upload/files/1383498967.pdfIn PDF document text
- https://senzedigicraft.com/wp-content/plugins/super-forms/uploads/php/files/d429743ee100f8fdff21fbe4dd6af996/81341997144.pdfIn PDF document text
- https://arkadas.yuzuktr.com/eskortarama.com/resimler/file/65898746720.pdfIn PDF document text
- http://trevorhannant.com/zevezisowefu.pdfIn PDF document text
- https://canevastoilestjean.com/upload/editor/file/81972939046.pdfIn PDF document text
+9 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0005fc0a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5FC0A	16904 bytes
SHA-256: `2aa297e5dcfe909f00c833d9058428942248b28dc1855efdaa908523ee63321c`
`font_01_sfnt_off00062862.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62862	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off00063f8e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x63F8E	10936 bytes
SHA-256: `c2400be2de4a3f87e1b7d8ba05bfab3ca1f2332528a07f0873e5361301afe563`

Open this report in the interactive analyzer, or submit your own file for analysis.