Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2287d40c96ef9c8…

MALICIOUS

PDF

96.4 KB Created: 2021-07-13 19:00:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: b10328f65a1ec9443e97892a5915f483 SHA-1: 8b5b2d9062b3b11e69b2cdbea7203322c69bde74 SHA-256: a2287d40c96ef9c81584ebaa1edb144ff9d92f6b3c298af77ce623f58d88ebf8
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier. It contains numerous links to external websites, many of which are hosted on compromised CMS platforms or disposable domains, indicating a link farm designed to redirect users to malicious content. The presence of embedded JavaScript, though obfuscated, suggests potential for further malicious actions like downloading second-stage payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9918

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://biotop-zamosc.pl/userfiles/file/kisufuligomode.pdf In PDF document text
    • http://www.petercar0937494634.com/upload/img/files/67322331397.pdfIn PDF document text
    • http://treeoflifetolfu.com/clients/0/07/07f122ebb3396bb3f917f2e62af81596/File/joxefit.pdfIn PDF document text
    • https://baongochoa.com/upload/file/xililirozudobifidiweni.pdfIn PDF document text
    • https://proff-doors.ru/wp-content/plugins/super-forms/uploads/php/files/cb261cf27d87f087fdd1206764c9fdaa/41848364385.pdfIn PDF document text
    • http://www.onekaddy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072c34e78d3a---wisawakomo.pdfIn PDF document text
    • http://www.peopleoftheheath.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c585add9e01---widakekoxigodeji.pdfIn PDF document text
    • https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/3441868e3c4359c530b0980666747464/disupuvomarure.pdfIn PDF document text
    • http://optimus.org.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608bc81735349---muropusujeperuwoverovuz.pdfIn PDF document text
    • http://claudiodauelsberg.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16081ceb85de7b---kuvigureru.pdfIn PDF document text
    • https://tehnol.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1609db7e39ae29---damaxujesumazi.pdfIn PDF document text
    • http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/nlq1st5vn76l9e8qg6g2rna8q1/gidumireribulalal.pdfIn PDF document text
    • https://advicezone.org.uk/wp-content/plugins/super-forms/uploads/php/files/6simrjfcnpid019dgjs58b4qso/batebevotukikojuzan.pdfIn PDF document text
    • http://brodart01.com/wp-content/plugins/super-forms/uploads/php/files/35egj3j62o27ph9td5npfl5fsr/28229987727.pdfIn PDF document text
    • https://kiameds.com/images/upload/files/18636282981.pdfIn PDF document text
    • https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/uu092i4sstsku8g2lvltotbl10/81632418909.pdfIn PDF document text
    • https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbfe789f86---58150129448.pdfIn PDF document text
    • https://elitstroycraft.ru/source/file/60029818590.pdfIn PDF document text
    • https://dineflon.com//files/rubojawubu.pdfIn PDF document text
    • https://metricgroup.it/uploads/file/7682631489.pdfIn PDF document text
    • https://dafelia.com/files/femowugamemiruzovi.pdfIn PDF document text
    • https://loskutova.site/wp-content/plugins/super-forms/uploads/php/files/d08b391162c8f551209d7746449b2065/92882288097.pdfIn PDF document text
    • https://henklinders.nl/henklinders/upload/files/81518597139.pdfIn PDF document text
    • http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aff9d833d68---fakivikolusugarimubu.pdfIn PDF document text
    • http://bulongvungtau.com/media/ftp/file/pesatifibisukexosaput.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=heat+transfer+is+a+path+functionPDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fbc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFBC2 18472 bytes
SHA-256: 86d9f4a383b061ab84acbbf240472d809b384e28edf8903d7168612cea04d48f
font_01_sfnt_off00012ca7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CA7 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off000144be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x144BE 10624 bytes
SHA-256: c2fc5a7fb80aeb8e3aec088c7c7ef32f6f50f9402ca9e211bd1b83380d0a6259
font_03_sfnt_off00015cf1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15CF1 16084 bytes
SHA-256: 325c5f5cda05429ae92d15c23118ca1b8712e485108c584e1e30b0ff615913b7

Open this report in the interactive analyzer, or submit your own file for analysis.