Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa8c4769f20e9a6a…

MALICIOUS

PDF

175.9 KB Created: 2022-02-06 00:22:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-07
MD5: fe23edf2f634c552628ae17db6b0ac45 SHA-1: 52ba38c37be9ec6da30bbde3c594fde87e377811 SHA-256: aa8c4769f20e9a6af42f1f44bb38eb94092f8608637a1c3c1f1742653e78ca27
156 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7303

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tevav.co.za/XSRYdR1H?utm_term=assisi+convent+school+noida+admission+form PDF link annotation
    • http://paillasse.hu/userfiles/file/jenafemogex.pdfIn PDF document text
    • http://www.atad.ae/emanager/assets/ckeditor/plugins/kcfinder/upload/files/64426053491.pdfIn PDF document text
    • http://koovappadyscb.com/ckfinder/userfiles/files/gokovutimefar.pdfIn PDF document text
    • http://24horasnoar.com.br/ckfinder/userfiles/files/zosut.pdfIn PDF document text
    • https://armagedonspedycja.pl/files/file/potixixafadalekanu.pdfIn PDF document text
    • https://aykutemlak.com/upload/ckfinder/files/xedewulosajorosuwupeviti.pdfIn PDF document text
    • https://unitedpetexpress.unitedreloth.com/ckfinder/userfiles/files/29947641490.pdfIn PDF document text
    • https://onderhoudnlgarantie.nl/upload/file/losijupifakipak.pdfIn PDF document text
    • http://www.detskaoptika.cz/ckfinder/userfiles/files/79062768745.pdfIn PDF document text
    • http://techsystem.gr/data/uploads/ckeditor/files/tofowadefamew.pdfIn PDF document text
    • http://lousart.com.br/ckeditor/kcfinder/upload/files/bodosidilejak.pdfIn PDF document text
    • http://www.donboscovizag.org/images/files/50253678494.pdfIn PDF document text
    • http://eot.mn/uploads/userfiles/files/vurilutifef.pdfIn PDF document text
    • http://abnicum.ru/files/file/25764456063.pdfIn PDF document text
    • http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/161aa496dc2ea3---gekovixigatezipuw.pdfIn PDF document text
    • https://0900107678.com/upload/file/40463103255.pdfIn PDF document text
    • https://associazionebriciole.it/public/file/digososodetakatudur.pdfIn PDF document text
    • https://hgb.se/filer/file/worugurizop.pdfIn PDF document text
    • https://taevlingar.se/images/pages/file/fevedipolowo.pdfIn PDF document text
    • http://bilafafafa.com/shopadmin/upload/files/kikinituwivejepid.pdfIn PDF document text
    • https://sproname.com/files/userfiles/files/wijozugivemojuwira.pdfIn PDF document text
    • https://biroestarsa.hu/uploads/file/68936239420.pdfIn PDF document text
    • http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/160fffc9828112---sobonugikerikegone.pdfIn PDF document text
    • https://tonmathunglan.vn/upload/files/mavivesupukuti.pdfIn PDF document text
    • https://rafaellopezehijo.com/upload/files/16998920269.pdfIn PDF document text
    • http://fijiembajak.com/uploads/ck_uploads/files/53377810726.pdfIn PDF document text
    • https://miamiuniquelimo.com/wp-content/plugins/formcraft/file-upload/server/content/files/161d1e8facf9d2---33855016128.pdfIn PDF document text
    • http://c2r-auto.com/uploadfiles/file/2021102105075473499.pdfIn PDF document text
    • http://mawratanews.com/armedia/uploads/files/supumesoduz.pdfIn PDF document text
    • http://www.immiflex.com/wp-content/plugins/formcraft/file-upload/server/content/files/1618b36600fc74---67532465921.pdfIn PDF document text
    • https://mimpishio1bet.com/contents//files/lofixizirinapigixibezox.pdfIn PDF document text
    • https://impariant-club.ru/wp-content/plugins/super-forms/uploads/php/files/67510be71ccbba1ecc4e843fbb6fa86d/dojebozemafajax.pdfIn PDF document text
    • http://patroha.hu/file/kajumubavo.pdfIn PDF document text
    • http://topliving.sk/userfiles/file/87276493503.pdfIn PDF document text
    • http://studiodabo.eu/userfiles/files/73849473978.pdfIn PDF document text
    • http://mclarenquartz.in/ci/userfiles/files/lepogixebafekerigiwinut.pdfIn PDF document text
    • https://centralleiloes.com.br/admincentral/ckeditor/kcfinder/upload/files/74572734392.pdfIn PDF document text
    • http://tentauto23.ru/ckfinder/userfiles/files/vufitapuriroja.pdfIn PDF document text
    • http://lawcab.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1615678bb03e72---fapapubixagi.pdfIn PDF document text
    • http://studiotecnicopetrillo.eu/userfiles/files/wolaroguxudamosif.pdfIn PDF document text
    • http://gamebonda.com/ckupload/files/50722971059.pdfIn PDF document text
    • http://www.meglobalinc.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/161a543c781b83---64225056655.pdfIn PDF document text
    • http://thanhlapcongtykiengiang.com/upload/ck/files/53360833227.pdfIn PDF document text
    • http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/161ad2c66b164a---gabirapufarideb.pdfIn PDF document text
    • http://fuku-zou.com/userfiles/file/10417716295.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    +4 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000253b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x253B2 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9
font_01_sfnt_off00026ad2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26AD2 10788 bytes
SHA-256: 51557b3591b0a216be8510846c25b2fd7e671a33f866c54653147e19e9714a35
font_02_sfnt_off00028379.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28379 16596 bytes
SHA-256: 335b213b19a892b56d3c44a400c866f91c7e9821427eb6007f78692efadc26e4

Open this report in the interactive analyzer, or submit your own file for analysis.