PDF malware analysis — malicious · 7828962de3987f91

MALICIOUS

PDF

237.8 KB Created: 2022-02-20 14:54:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-16

MD5: 2e77ff7d3a55d8c6e4f21ca2b17f98ef SHA-1: 8154247d5624b4ca0edf812158c9afb2e805f53f SHA-256: 7828962de3987f91d896bc799ad61a802be7a0503c333c2a625222daa7fbf2b3

166 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.7221

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cafij.co.za/XSRYdR1H?utm_term=anesthesiology+news+buyers+guide PDF link annotation
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/16174fb2b4a63e---mamakojawovometogoge.pdfIn PDF document text
- http://sapientgenerator.ru/files/userfiles/files/velevutowetisupane.pdfIn PDF document text
- http://vietsonplastic.com/uploads/userfiles/file/jusuguku.pdfIn PDF document text
- https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/161e5e64133529---58512431488.pdfIn PDF document text
- http://ahxxzx.com/userfiles/202112/file/59749042325.pdfIn PDF document text
- https://www.info-service.com.tw/plugin/ckeditor/ckfinder/userfiles/files/46666765890.pdfIn PDF document text
- https://gbp.dropship-online.com/userfiles/files/budurana.pdfIn PDF document text
- https://www.c2commercial.com/wp-content/plugins/super-forms/uploads/php/files/6b655ca1515e833210469305faaeaf02/30797685439.pdfIn PDF document text
- https://www.karelo.com/uploads/File/69827462128.pdfIn PDF document text
- https://citronixdeflection.com/nbloom/fckuploads/file/lelidoxewevurodevaw.pdfIn PDF document text
- https://vgcanada.com/userfiles/file/firewutenagodemi.pdfIn PDF document text
- http://gcsiva.com/files/userfiles/file/vawibiluxovuxegut.pdfIn PDF document text
- http://nhatngungoisaoxanh.com/upload/files/momigiwuduxupowonapon.pdfIn PDF document text
- https://dgaspcsm.ro/ckfinder/userfiles/files/6143101532.pdfIn PDF document text
- http://www.leesii.com/wp-content/plugins/formcraft/file-upload/server/content/files/16102fc6695030---37776185888.pdfIn PDF document text
- http://www.naraihillgolf.com/admin/userfiles/file/lawepesirasegoviw.pdfIn PDF document text
- https://www.psk.com.au/application/third_party/ckfinder/userfiles/files/bekepev.pdfIn PDF document text
- http://techbis.pl/files/file/dozivitawexixevevemo.pdfIn PDF document text
- http://111-orte.de/testarea/cwsCMSlight/media/files/1991698498.pdfIn PDF document text
- https://gagasanriau.com/a450d92cb6be01b3b3669c18bfca7901/kcfinder/upload/files/levonobijodifekafe.pdfIn PDF document text
- http://matkinhantai.com/luutru/files/38803779694.pdfIn PDF document text
- http://www.culturehousesun.org/photos/file/16968715678.pdfIn PDF document text
- http://architettosirocco.it/userfiles/files/71319225735.pdfIn PDF document text
- http://thegioichuyendong.info/app/webroot/upload/files/paxamiwugovorumerazu.pdfIn PDF document text
- http://aryajob.com/user_upload/file/saxetetorujami.pdfIn PDF document text
- https://casabresciani.it/uploads/file/77454399404.pdfIn PDF document text
- http://eastcoastbiker.de/sites/default/files/file/sonideseselovesiwu.pdfIn PDF document text
- https://reparationmobile.net/userfiles/file/97679975391.pdfIn PDF document text
- http://a-pro-peau.fr/userfiles/file/99995393139.pdfIn PDF document text
- http://khodahoanglang.com/admin/webroot/upload/image/files/labekasobisozujiv.pdfIn PDF document text
- https://www.pmayassam.in/assets/kcfinder/upload/files/lufuro.pdfIn PDF document text
- http://dongamold.com/fckeditor/upload_files/file/givomafosuzusupofileko.pdfIn PDF document text
- https://fallsplat.se/bildbank/file/kevizipalibedapenoxuwowab.pdfIn PDF document text
- http://aviatechinform.ru/sadm_files/68931582564.pdfIn PDF document text
- https://parfumzone.ro/files/file/76383165876.pdfIn PDF document text
- https://truongdongkinh.phapluatvietnam.com/upload/ckupload/files/32077800209.pdfIn PDF document text
- http://doctour.hu/uploads/ckfinder/userfiles/files/44685750365.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/161873fc70bc11---noroweguzusidixirapid.pdfIn PDF document text
- http://soosanfix.com/upload/fckeditor/file/besuxovalikovutavejod.pdfIn PDF document text
- http://ux-school.ru/files/files/meladolonalajogo.pdfIn PDF document text
- https://naukriguru.com/php/uploads/file/razubojijipeneleresob.pdfIn PDF document text
- https://dolaodong.baohohoanglong.com/userfiles/file/1202132383.pdfIn PDF document text
- http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/1620c1c3073533---79747696940.pdfIn PDF document text
- https://cincia.ro/ckfinder/userfiles/files/ruwez.pdfIn PDF document text
- https://pmayassam.in/assets/kcfinder/upload/files/64746038461.pdfIn PDF document text
- https://alkirbilaw.com/userfiles/files/tatexofuwasu.pdfIn PDF document text
- https://healthmatters.me/userfiles/file/xizoxekisexufezenuna.pdfIn PDF document text
- http://euro-service.org/kcfinder/upload/images/61880340463.pdfIn PDF document text
- http://mypham.privia.vn/userfiles/file/lugawexava.pdfIn PDF document text
+11 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00034728.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x34728	18260 bytes
SHA-256: `0f674d48527be971d13fb1d889466a566f1d2519be3ea7bfa00a8ab58731fe0d`
`font_01_sfnt_off0003767f.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3767F	10788 bytes
SHA-256: `d7b847304cef257ac6f8fdfbf91876f54a84d9e8ab9b722eb4b952cd898839da`
`font_02_sfnt_off00038f32.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x38F32	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`

Open this report in the interactive analyzer, or submit your own file for analysis.