Malicious PDF — malware analysis report

Static analysis result for SHA-256 53333b79a52f908d…

MALICIOUS

PDF

80.9 KB Created: 2021-06-29 03:23:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: 776e3012a65e949d84ff18c404c1dc9b SHA-1: 4180f77b0030c45063740375755a13628271a6ce SHA-256: 53333b79a52f908d51afd39d4feb4fec780e128f1461b757c428f67bb264beac
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by an ML classifier as malicious. It contains a link farm with numerous URLs pointing to compromised CMS uploads and disposable hosting, suggesting a phishing or malware distribution campaign. The primary attack pattern involves directing users to external malicious sites via embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 5

  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/uplcv?utm_term=land+for+sale+mill+spring+nc PDF link annotation
    • http://saintthomasmonrovia.org/clients/a/a7/a774d5b45fc75aba9c6fcf07501e1e58/File/49231343668.pdfIn PDF document text
    • http://taskentcompany.com/userfiles/file/gigekivemogogube.pdfIn PDF document text
    • https://www.wikiwebagency.it/wp-content/plugins/super-forms/uploads/php/files/bbe48da6310119b8c21e9d030ad355ae/komaxiteragosili.pdfIn PDF document text
    • http://energo-winstal.pl/userfiles/file/7644491614.pdfIn PDF document text
    • https://dmddsgn.com/wp-content/plugins/super-forms/uploads/php/files/0addda8ec1ce9334e87a3c6f811e3245/78426953182.pdfIn PDF document text
    • https://www.qlsny.com/wp-content/plugins/super-forms/uploads/php/files/5e557cc8accf5b43693c8ecd81a22924/bimogetozejunumuxulojaxer.pdfIn PDF document text
    • http://parkwestresidences.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ade98be5700---16262555851.pdfIn PDF document text
    • http://timnhanhonline.vn/upload/files/68221174638.pdfIn PDF document text
    • https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071850923879---tewusarefejumelex.pdfIn PDF document text
    • https://artbynela.com/uploads/file/31627296595.pdfIn PDF document text
    • http://jagatjyotischool.org/jagatjyotischool/userfiles/file/kufigeveribegigazexof.pdfIn PDF document text
    • https://www.harasportcenter.com/wp-content/plugins/super-forms/uploads/php/files/ccd72tpjrco99l7keokd5fb4ch/famasijeduxesogedilagi.pdfIn PDF document text
    • http://global-poseg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a383d4ebcb4---gategivemegi.pdfIn PDF document text
    • http://lbtech.kr/upfile/files/fujizolelepozozeriv.pdfIn PDF document text
    • https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090a0c13bc78---97149698479.pdfIn PDF document text
    • https://burmesecatclub.nz/wp-content/plugins/super-forms/uploads/php/files/88673a0778aaf932e15d6cf3528fdcf8/genubokit.pdfIn PDF document text
    • https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/bt3o7ij25u9gol2n26nqtpcpds/niwosatu.pdfIn PDF document text
    • http://wypelnienia.kratex.pl/wp-content/plugins/super-forms/uploads/php/files/19c9aec518a346b82c31f91fa218f5a4/libutejalavebuzubewimosuk.pdfIn PDF document text
    • http://absigorta.com/E/file/garibipovunekagi.pdfIn PDF document text
    • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/ggnn4k8a13s8m1iu822phmtefp/37807057676.pdfIn PDF document text
    • http://yuha.be/_files/file/fivudoku.pdfIn PDF document text
    • https://ateneoarbonaida.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093e715f365e---jovatu.pdfIn PDF document text
    • https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/sid4u4ght1mtprs2cffbfck2go/joxijisakixusi.pdfIn PDF document text
    • https://indacphuc.com/wp-content/plugins/super-forms/uploads/php/files/n79qrinplprvb3ucimqn8f137i/56568079713.pdfIn PDF document text
    • http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a5d703247d1---82540271491.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD7E6 10820 bytes
SHA-256: 8a95578020b5e4a1ba61b5b8ab39aec6ab09a93677e3402b4a40e3fa299099d8
font_01_sfnt_off0000f090.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF090 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000108a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x108A2 17304 bytes
SHA-256: 67534278695bf9663a4fe16a28d65f42365a5c3d347517f123dae1dda1b78448

Open this report in the interactive analyzer, or submit your own file for analysis.