PDF malware analysis — malicious · 7826bd28b5484052

MALICIOUS

PDF

234.5 KB Created: 2022-03-08 03:38:29 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-16

MD5: 4cc14a04cf7b8890b5bc3c898fb0a8fe SHA-1: ea1afd229db4cc7b1da76c6d14127705ae27e289 SHA-256: 7826bd28b54840529285fa49267d5d58d113c69606faaa9956b9b8cb7264577f

174 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.7620

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://colod.co.za/XSRYdR1H?utm_term=lagu+dj+alan+walker+spectre+remix PDF link annotation
- https://egyediajandekotletek.hu/mvc/userfiles/file/74134118194.pdfIn PDF document text
- http://ailin.kz/js/kcfinder/upload/files/zuwonadinetedejupafi.pdfIn PDF document text
- http://uniqsofttech.com/userfiles/file///taxiror.pdfIn PDF document text
- http://etiquettes-adhesives-bobine.fr/kcfinder/upload/files/18767788598.pdfIn PDF document text
- https://archguruorg.welkinovation.com/admin/UserFiles/images/files/petifene.pdfIn PDF document text
- http://vankouwenenmastop.nl/UserFiles/file/novetikonomawoxobo.pdfIn PDF document text
- https://sofupingame.com/calisma2/files/uploads/xexovopikatipodifupana.pdfIn PDF document text
- http://labradory.pl/file/dalaloremefox.pdfIn PDF document text
- http://www.serge-valentin.net/ckfinder/userfiles/files/78219547470.pdfIn PDF document text
- https://posaonakosovu.com/ckfinder/userfiles/files/65149379553.pdfIn PDF document text
- http://ipsc-pv.cz/kcfinder/upload/files/32583779436.pdfIn PDF document text
- https://bimstudioinc.com/media/files/gasajo.pdfIn PDF document text
- http://mastrodibaglio.it/userfiles/files/wajezogelubirogiworesolu.pdfIn PDF document text
- http://gniortho.com/files/Upload/file/pugusususokepeliresalupig.pdfIn PDF document text
- http://antopol.topmebli.com/content/xuploadimages/file/46545498602.pdfIn PDF document text
- http://osullivanspressurewashing.com/wp-content/plugins/formcraft/file-upload/server/content/files/16216c2b923b0b---disevudinujadizamatud.pdfIn PDF document text
- http://xn----8sbemnkjd7bfu.xn--p1ai/design/img/upload/file/xedexuw.pdfIn PDF document text
- https://www.tiad-mtm.com/assets/admin/js/plugins/kcfinder/upload/files/goget.pdfIn PDF document text
- https://equinox-e.com/upload/files/17197583122.pdfIn PDF document text
- http://thaisomboonautopart.com/userfiles/files/wedudatuv.pdfIn PDF document text
- http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/16200f107c4988---90944773390.pdfIn PDF document text
- http://csigikes.hu/admin/fck_upload/file/57436233271.pdfIn PDF document text
- https://nepalipublisher.com/ckfinder/userfiles/files/92370034331.pdfIn PDF document text
- http://bunkerhill.thriftstorewebsites.net/flash/bunkerhill.thriftstorewebsites.net/file/devexuduwegubu.pdfIn PDF document text
- http://www.firstpages.eu/app/webroot/files/userfiles/files/31281871744.pdfIn PDF document text
- https://ateneoarbonaida.com/wp-content/plugins/formcraft/file-upload/server/content/files/16205b80dc387a---futemuzoduzivut.pdfIn PDF document text
- http://mebizstekla.ru/userfiles/file/80006545919.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621597aa35572---99715276633.pdfIn PDF document text
- http://easytravel63.ru/ckfinder/userfiles/files/84056165527.pdfIn PDF document text
- http://www.maoles.com/wp-content/plugins/formcraft/file-upload/server/content/files/16212ca3e7519f---jifuguxivawapalamox.pdfIn PDF document text
- http://dongamold.com/fckeditor/upload_files/file/zusexupivebaxu.pdfIn PDF document text
- http://kydceramics.com/upload/userfiles/files/kexinigakowusijuxiwafosi.pdfIn PDF document text
- https://agrimal.pl/userfiles/file/14238106392.pdfIn PDF document text
- http://aktasmatbaacilik.com/resimlerfiles/44110280885.pdfIn PDF document text
- http://spynet.gr/Administrator/uploads/userpics/OutPostImages/files/jenid.pdfIn PDF document text
- http://jg-academy.com/uploads/FCKeditor/file/kevogusajasapikupe.pdfIn PDF document text
- http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/97ac1bb7a0929a769b5e94fa1fb984ab/sevililibirapasifakofotej.pdfIn PDF document text
- http://www.combatsim.eu/wp-content/plugins/formcraft/file-upload/server/content/files/161fcc06512c60---vonupagadavitakijaga.pdfIn PDF document text
- http://protech-t.hu/kcfinder/upload/files/kametokodejegajazamamovo.pdfIn PDF document text
- http://azv-goldeneaue-uthleben.de/kcfinder/upload/files/dowenu.pdfIn PDF document text
- https://kopari.hu/files/file/84882893863.pdfIn PDF document text
- http://papierplus.pl/userfiles/file/binedomebomegudagi.pdfIn PDF document text
- http://testsitehq.com/ckeditor-ckfinder-integration/uploads/files/fetoxume.pdfIn PDF document text
- https://www.anefescuela.es/files/febenerasemazesidi.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
+3 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000339bd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x339BD	11204 bytes
SHA-256: `00a5508f04483b687044acb35cff212f27440d0ce7348a2399effaf2b0a059df`
`font_01_sfnt_off000353cd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x353CD	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off00036ae8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x36AE8	18132 bytes
SHA-256: `e4092a54954c7b9a56cf17092abc33f4afe36658445ba2eb446454160ea24f62`

Open this report in the interactive analyzer, or submit your own file for analysis.