PDF malware analysis — malicious · 5d8d7f3fe0cafd1b

MALICIOUS

PDF

177.6 KB Created: 2021-08-08 15:24:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-18

MD5: 81e60207c7fb06a7c636eeaa3cc77465 SHA-1: cff00d4a453f9a038a58fbc3a4e2462edc00ce99 SHA-256: 5d8d7f3fe0cafd1bd5d11b8e8dbca144933f232fe8f6230e7c3446eb24e718c5

156 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9967

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://iescolumbus.org/wp-content/plugins/super-forms/uploads/php/files/fce6ef97da4401083f6a5148f81540aa/35824141412.pdf In PDF document text
- http://costanzolegal.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/56853562262.pdfIn PDF document text
- https://www.perfumista.co.uk/wp-content/plugins/super-forms/uploads/php/files/46dd8f7bd75cb7ef4f8a0c276dd06e84/rikusalixukawo.pdfIn PDF document text
- http://davcpundri.com/css/file/lifovixukapowunitulidovab.pdfIn PDF document text
- http://shuswapladystriders.ca/userfiles/file/53006240389.pdfIn PDF document text
- https://lerong.vn/wp-content/plugins/super-forms/uploads/php/files/2bb1d49d6a57f77d6cfe4b4a334c8124/86863629470.pdfIn PDF document text
- http://impressivetravelvietnam.com/upload/files/lazojewupigegasopek.pdfIn PDF document text
- https://watertorens.nl/userfiles/file/guwug.pdfIn PDF document text
- https://chpcentre.com/files/file/89668532389.pdfIn PDF document text
- http://ailizia.com/userfiles/60338136319.pdfIn PDF document text
- http://struttur-arch.it/userfiles/files/84128045704.pdfIn PDF document text
- https://www.hediyevideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd0bb880d86---kijefenekukivileluz.pdfIn PDF document text
- http://patrick-vallot.com/upload/files/rumarad.pdfIn PDF document text
- http://www.pianoszimmermann.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608c3da377707---fajafaxafejud.pdfIn PDF document text
- https://bbpartner.cz/userfiles/file/segeloji.pdfIn PDF document text
- http://drapa-technika.cz/UserFiles/File/81507462829.pdfIn PDF document text
- http://beloit1962.com/clients/8/83/8368a4f838dea3176655029ae9e337da/File/26096422458.pdfIn PDF document text
- http://clairvoyantinfotech.com/demo/images/dipuvovug.pdfIn PDF document text
- http://daimarconstrucciones.com/images/admin/file/zakifokokon.pdfIn PDF document text
- https://www.projectorrentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8739d791b9---xabanu.pdfIn PDF document text
- http://hieuchuan.com/upload/files/vawazelilapolifinufobove.pdfIn PDF document text
- https://www.area-tlc.com/public/ckfinder/userfiles/files/24525272295.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=types+of+context+clues+example+sentences+brainlyPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00024cc5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x24CC5	11060 bytes
SHA-256: `5ca8c085a67890ba1d024f92da15bf1b26e4407e19dd3f163a6379e65c793e7a`
`font_01_sfnt_off00026662.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x26662	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off00027e74.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x27E74	22000 bytes
SHA-256: `33430fd2b695912d2254beec264967070216abd04c2ceb0386ae2d725db06460`

Open this report in the interactive analyzer, or submit your own file for analysis.