Malicious PDF — malware analysis report

Static analysis result for SHA-256 c442cd66b0da3127…

MALICIOUS

PDF

181.0 KB Created: 2021-06-27 12:50:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: c8720574ef94dcb187ff5849279c2b46 SHA-1: 6a90672a50c31e6d8409e111b95edab7d1087564 SHA-256: c442cd66b0da3127241c0b770b9c6f26d9d145c0145e88d57bf13b7ed2610c8c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document that exhibits characteristics of an advance-fee scam, likely intended to trick the user into downloading a malicious payload. The document contains numerous links to compromised WordPress upload storage, suggesting a distribution mechanism for further malicious content. While no scripts were directly extracted, the PDF structure and heuristic firings strongly indicate a malicious intent to deceive users into downloading further malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9916

Heuristics 6

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.revistadefiesta.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d48f506c870---45305238638.pdf In PDF document text
    • http://www.ambredore.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a725e4c16a4---48320196913.pdfIn PDF document text
    • http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607322cf89262---48896583024.pdfIn PDF document text
    • http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d730b8ceaaa---gibaxubupoxexilaraje.pdfIn PDF document text
    • https://cvenhancer.com/wp-content/plugins/super-forms/uploads/php/files/f6328154d52b4726bf62edf021742e50/75501661031.pdfIn PDF document text
    • https://allcreaturesinc.com/files/files/60919507701.pdfIn PDF document text
    • http://coalcreekcentenary.com/clients/5/52/52f735e63eff8706e1a2a73a20aef632/File/xuvulonedip.pdfIn PDF document text
    • https://www.getfitcrew.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081cee806e5a---nixafigomuv.pdfIn PDF document text
    • http://solarhomepage.ch/fckeditor/editor/images/file/ziwakejezulizir.pdfIn PDF document text
    • http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160818fd6c7029---53647211446.pdfIn PDF document text
    • http://hkacca.com/userfiles/xoponudusuxibibuxiweku.pdfIn PDF document text
    • http://quick-thailand.com/images/uploads/file/ganejoboborarefitotalix.pdfIn PDF document text
    • https://www.golddustdental.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609fa03185e87---wamavilonor.pdfIn PDF document text
    • https://rittenhousesmiles.com/wp-content/plugins/super-forms/uploads/php/files/ede4dc76c903ee64f6a82091fd9077c3/18958859353.pdfIn PDF document text
    • http://www.jcca.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/160c03a0f35876---32684416163.pdfIn PDF document text
    • https://repare-ton-smartphone.com/userfiles/file/15161953278.pdfIn PDF document text
    • http://ongnuocdenhat.com/upload/files/bazebimujoni.pdfIn PDF document text
    • https://www.sidertest.it/wp-content/plugins/formcraft/file-upload/server/content/files/16073b71fe05c0---bereva.pdfIn PDF document text
    • http://okeefesreef.com/ckfinder/userfiles/files/46882045393.pdfIn PDF document text
    • https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/16088aa6ff14d5---37543772513.pdfIn PDF document text
    • http://bajcsidavidfoto.com/_user/file/61288713133.pdfIn PDF document text
    • https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/c2cdb18a79868cdcdcf6410b0d95a681/53593871123.pdfIn PDF document text
    • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608550db9e279---sakuramutenibiron.pdfIn PDF document text
    • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=teleport+back+in+timePDF link annotation
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000263a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x263A0 10564 bytes
SHA-256: 8e172b82aa4ec304b44723317a6efa7b23b4f9cbc621eb9f3f6c259658f0308f
font_01_sfnt_off00027b74.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x27B74 20540 bytes
SHA-256: 2312b4cd66f20334e2aeffb7c34fca5fa5fcb5d36ff9f7a58cc900e5763da7c2
font_02_sfnt_off0002aea3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2AEA3 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1

Open this report in the interactive analyzer, or submit your own file for analysis.