PDF malware analysis — malicious · aa81111bff872026

MALICIOUS

PDF

405.5 KB Created: 2022-03-05 15:26:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-06

MD5: 21b6479504feafc107bd6067c6d13a36 SHA-1: bd34868dad6a31bce90f698d17d1fcafc793e01f SHA-256: aa81111bff872026d76e2732c633ab5fa6049490cb11ecbd51255a73cb48ecb5

166 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.5598

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://loheb.co.za/XSRYdR1H?utm_term=work+attendance+record+sheet PDF link annotation
- https://vgcanada.com/userfiles/file/76280335944.pdfIn PDF document text
- https://revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621fc9aa71592---33384152253.pdfIn PDF document text
- http://pusat.wellcomm.co.id/assets/kcfinder/upload/files/9297812036.pdfIn PDF document text
- http://mirgalosh.moscowfashion.net/content/xuploadimages/file/50650048167.pdfIn PDF document text
- http://hk-keber.de/images/file/55670761371.pdfIn PDF document text
- http://sciencevier.com/wp-content/plugins/formcraft/file-upload/server/content/files/16205cb02e1477---vuvezubilizaruvoj.pdfIn PDF document text
- https://hgd.hr/admin/kcfinder/upload/files/33009520125.pdfIn PDF document text
- https://careerexpo.alljobsinliberia.com/ckfinder/userfiles/files/30007509071.pdfIn PDF document text
- https://parisautotravel.com/wp-content/plugins/super-forms/uploads/php/files/shdvot6ap3eqnfmoig3rh5a8p3/gepititajimukuga.pdfIn PDF document text
- http://macautemple.com/userfiles/file/22986422837.pdfIn PDF document text
- http://speaklifeiamgreatness.com/files/files/xetavunojekuvudizezo.pdfIn PDF document text
- http://c-six.it/userfiles/files/woduboleriledadij.pdfIn PDF document text
- http://www.jindatunnel.com/up_files/file/rabajalanakedevarodi.pdfIn PDF document text
- https://www.trafiktehaklarim.org/kcfinder/upload/files/ruroluga.pdfIn PDF document text
- https://administrador.bannik.com/benkio/files/babimapuzopajapapetev.pdfIn PDF document text
- https://pyreneesjogja.com/kcfinder/upload/files/zexini.pdfIn PDF document text
- http://xmzhj.com/UserFiles/file/31336787955.pdfIn PDF document text
- http://flashdisplay.net/UploadFiles/FCKeditor/20220206112809.pdfIn PDF document text
- http://comercialardevolana.net/admin/kcfinder/upload/files/xidewewates.pdfIn PDF document text
- http://faradtvandor.hu/picture/userfiles/file/mawegajiluzalunibejixot.pdfIn PDF document text
- http://comac-international.cz/userfiles/file/mesufunojatedijabajeti.pdfIn PDF document text
- https://www.andimoda.com/wp-content/plugins/super-forms/uploads/php/files/23ee39ce7428d567b1473a1e798c13b0/regefananojadonigurok.pdfIn PDF document text
- http://chinalabware.es/d/files/59423610956.pdfIn PDF document text
- http://centronegozi.com/public/zikasedureluke.pdfIn PDF document text
- https://mobile-translator.eu/app/webroot/media/files/60388865796.pdfIn PDF document text
- http://activesites.atiks.org/files/zojuladage.pdfIn PDF document text
- http://physocare.com/Images_upload/files/73597760656.pdfIn PDF document text
- https://tkaniny-svitap.cz/kcfinder/upload/files/48895735573.pdfIn PDF document text
- https://twojeloty.pl/admin/kcfinder/upload/files/24308758360.pdfIn PDF document text
- http://dj-maily.com/uploads/pages/files/74832606207.pdfIn PDF document text
- http://www.culturehousesun.org/photos/file/15663476184.pdfIn PDF document text
- https://derfo.info/resimler/files/79316505730.pdfIn PDF document text
- http://aleksey-mihalchik.ru/upload/files/xusawawenu.pdfIn PDF document text
- https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/16209490632fc2---13903544299.pdfIn PDF document text
- https://sincomerciariospv.com.br/kcfinder/upload/files/58546741769.pdfIn PDF document text
- https://mashura.co/userfiles/files/guxepugujedexepetitesakoz.pdfIn PDF document text
- http://creatinglifeoptions.com/userfiles/files/disumovubazaxegijo.pdfIn PDF document text
- https://vongtaytramhuong.vn/upload/files/86230010813.pdfIn PDF document text
- https://wilgekrans.com/admin/user_files/files/japunijikuteveberewiv.pdfIn PDF document text
- https://godahoian.com/app/webroot/upload/files/jikoxozobovewerexaledel.pdfIn PDF document text
- http://smartpaintingplus.com/userfiles/files/kuranus.pdfIn PDF document text
- http://arucax.am/user_images/file/95100173118.pdfIn PDF document text
- http://perfecturology.cafe24.com/upload/editor/imagefile/19272864595.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
+2 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0005e6aa.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E6AA	18232 bytes
SHA-256: `f514fa286c314174cc5015649f951702b4392ff90e960e32100f9e192f30a18d`
`font_01_sfnt_off00061673.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x61673	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_02_sfnt_off00062d9a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62D9A	10416 bytes
SHA-256: `455c1a3d4dbb43564550daa0b71d9466bcdfe6aeaa54c3fb05f9b5572992d585`

Open this report in the interactive analyzer, or submit your own file for analysis.