PDF malware analysis — malicious · 7933bf9769bd4845

MALICIOUS

PDF

82.4 KB Created: 2021-09-16 18:44:57 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-15

MD5: 4e77bf1b55b9cf9850efcd902541a76d SHA-1: 7c89e2702bd5f923dbfddb6e53b96ec15c177eff SHA-256: 7933bf9769bd48455dde60e336887fdeaf30c34c690cfeaa74dd3574587b62d2

156 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.9981

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/16140bc1954c6d---nagimewofopiwarexiluxikab.pdf In PDF document text
- https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613f0d5272ff8---30474382335.pdfIn PDF document text
- https://spvi.cn/filespath/files/20210916223247.pdfIn PDF document text
- http://lpxs168.com/filespath/files/20210911092556.pdfIn PDF document text
- https://pima-alarms.net/slicice/file/63523946192.pdfIn PDF document text
- http://old.arcnet.org.tw/ckfinder/userfiles/files/36559878776.pdfIn PDF document text
- https://wamsconference.com/wp-content/plugins/super-forms/uploads/php/files/c5e24190a82e50d0f05a19081eee4116/59997916971.pdfIn PDF document text
- http://mabo-meccanica.eu/userfiles/files/69247944871.pdfIn PDF document text
- https://shevian.com/images/file/49082544732.pdfIn PDF document text
- https://fotofidelity.cz/userfiles/file/57398201741.pdfIn PDF document text
- http://homearcky.nl/userfiles/file/xowapekimu.pdfIn PDF document text
- http://www.florentmaussion.net/userfiles/File/lezakixumujitilusufodid.pdfIn PDF document text
- https://momentous-inst.com/uploads/image/files/mazegox.pdfIn PDF document text
- http://auburn-companies.com/userfiles/files/45524450863.pdfIn PDF document text
- https://rougezenekar.hu/files/file/datobuwoxulur.pdfIn PDF document text
- https://lucky-erotic-massage-bucharest.ro/ckfinder/userfiles/files/96398289077.pdfIn PDF document text
- http://heryeryesil.com/resimlerfiles/xaxotuvuvotitavafopisob.pdfIn PDF document text
- http://speckletrack.com/update/editor/file/vatudowuvi.pdfIn PDF document text
- http://aaykpn.com/uploads/editor/files/misiliwusukepav.pdfIn PDF document text
- https://dogathermalhotel.com/resimler/files/66811522811.pdfIn PDF document text
- http://fese.in/ienupdimages/images/files/23474107922.pdfIn PDF document text
- https://www.reliancecareuk.com/wp-content/plugins/super-forms/uploads/php/files/a44e573c24579b33376f7ba407e8ef77/gasadituka.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=bumble+bee+nursery+rhyme+lyricsPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000dd39.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDD39	18052 bytes
SHA-256: `20252c6f7cf7543d37e8b73f5848c1f92b97718040a59bdf4ba200fd79945e18`
`font_01_sfnt_off00010bf5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10BF5	16792 bytes
SHA-256: `9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1`
`font_02_sfnt_off0001240c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1240C	10520 bytes
SHA-256: `07a083462028269cd11f2e97baabace3912a74eea6cbc78935fe5ad35188bd79`

Open this report in the interactive analyzer, or submit your own file for analysis.