Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd7e825470eac140…

MALICIOUS

PDF

175.7 KB Created: 2022-03-19 23:18:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-18
MD5: 645358f4c6a5a96e2f28316ba627b2ba SHA-1: 09ddb84bb7064e52e5ab67bd3b6b97e59bb2125b SHA-256: cd7e825470eac1409225b52156f5eb49338cb3aa68e42cde39aa8dc11c4b68e1
164 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.7943

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lovig.co.za/XSRYdR1H?utm_term=poweredge+r740+server+pdf PDF link annotation
    • https://webmanagement.laptopservice.ro/images/file/40286601923.pdfIn PDF document text
    • https://rugerwafers.com/demo/ruger/beta/userfiles/files/25452892310.pdfIn PDF document text
    • http://bdsductri.com/upload/files/zereviporegujixode.pdfIn PDF document text
    • http://anapharmata.hu/ckfinder/core/connector/php/files/lazeda.pdfIn PDF document text
    • http://chestheart.org/journal/assets/ckeditor/kcfinder/upload/files/dubumivisekiratidale.pdfIn PDF document text
    • http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/161fc9ae21f014---medewa.pdfIn PDF document text
    • https://supportsurgical.com.br/assets/kcfinder/upload/files/rajaxivawiwipude.pdfIn PDF document text
    • https://dbjadow.pl/attachments/file/46182256671.pdfIn PDF document text
    • http://lovepetclinics.com/file_media/file_image/file/zakixu.pdfIn PDF document text
    • https://riolisboa.com/images/ul_files/file/ZuBY1naiLhVC.pdfIn PDF document text
    • http://apartmany.cucoriedka.sk/data/files/35832404010.pdfIn PDF document text
    • https://ville-saintleonard.fr/pdf/71761451796.pdfIn PDF document text
    • http://www.zaluziemalina.cz/userfiles/file/rinalumafemidewemo.pdfIn PDF document text
    • http://bridgeonlaw.com/filespath/files/20220226132900.pdfIn PDF document text
    • https://www.swiftcargo.com/adminlogin/kcfinder/upload/files/51445708786.pdfIn PDF document text
    • http://bulk-supplies.com/userfiles/files/doralemewuxobogome.pdfIn PDF document text
    • https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/162042bf332954---kaweli.pdfIn PDF document text
    • https://hoya.hr/UserFiles/file/789408376.pdfIn PDF document text
    • https://exhibitproplus.epponline.com/mentorfinancial/page_images/file/99775403751.pdfIn PDF document text
    • http://architettipassarinmarzotto.com/userfiles/files/deludadubi.pdfIn PDF document text
    • http://xn----1-6cdapb2bdyqawnpcindqfc.xn--p1ai/media/file/8469657476.pdfIn PDF document text
    • https://fisheaglesafaris.net/pics/user/file/putumogefujudujepeg.pdfIn PDF document text
    • http://tlumacz-lipno.pl/pdrzewiecki/files/96060205091.pdfIn PDF document text
    • http://lexnovum.pl/js/kcfinder/upload/files/gulonulixis.pdfIn PDF document text
    • http://realtor-madrid.com/uploades/fckeditorfile/66327769805.pdfIn PDF document text
    • https://jamiatulbanat.in/wp-content/plugins/formcraft/file-upload/server/content/files/1622ba7488e635---kuruwiki.pdfIn PDF document text
    • https://speakingparrot.com/upload/ckfinder/files/mufimitojepej.pdfIn PDF document text
    • https://unitedfightalliance.com/ckfinder/userfiles/files/mimiximalijijodox.pdfIn PDF document text
    • http://secoinblock.com/upload/files/kenosagovifabut.pdfIn PDF document text
    • https://luxury77.com/kcfinder/upload/files/pevapasorexekil.pdfIn PDF document text
    • https://kupro.bg/upload/wyswyg/files/27397346603.pdfIn PDF document text
    • https://staging.smartmoneymatch.com/ckeditor/kcfinder/upload/files/tivajogijijixenefojuxe.pdfIn PDF document text
    • https://marblobaths.ph/app/webroot/img/files/28105357393.pdfIn PDF document text
    • http://vanguardhungary.hu/userfiles/file/74427511888.pdfIn PDF document text
    • http://biopole-clermont.com/uploads/gestion_contenu/files/36187041310.pdfIn PDF document text
    • http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16217c18783d62---12194245689.pdfIn PDF document text
    • http://kusistoconstruction.com/userfiles/file/54851666675.pdfIn PDF document text
    • https://halead.com/uploadfile/1644285679.pdfIn PDF document text
    • http://avvocato-callegaro.it/public/file/gabira.pdfIn PDF document text
    • http://tokado.ua/media/file/dakegupelisozika.pdfIn PDF document text
    • https://otomatcilarmetal.com/otomat/upload/files/tusubirusolotoxip.pdfIn PDF document text
    • http://louisiana-arts.org.s150269.gridserver.com/siteuploads/editorimg/file/zedowijobipol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    +1 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00024933.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24933 10576 bytes
SHA-256: 5ee1fa5aab2a3bab9b2ce16138c5a348af796b63427c026738672bb209ac9e32
font_01_sfnt_off00026161.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26161 21240 bytes
SHA-256: 1a0c48203e0bb5db25fc7901bc5a15098779af9df140276d5f067581087e6b72
font_02_sfnt_off000297f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x297F3 16560 bytes
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9

Open this report in the interactive analyzer, or submit your own file for analysis.