Malicious PDF — malware analysis report

Static analysis result for SHA-256 d50ddb985e28d371…

MALICIOUS

PDF

75.3 KB Created: 2021-05-20 22:08:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 9ed8c2e227c6ab8fd60b1da2a9c66912 SHA-1: f6751969828c604536d700f9d48e7facb54a591b SHA-256: d50ddb985e28d371dea2a9f279119dc84ffeb6c176937dcc672df5581fcc01d6
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm pointing to compromised WordPress sites, suggesting it's designed to redirect users to malicious content or phishing pages. The embedded URLs, such as http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099368668328---5089976940.pdf, are key indicators of this malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9355

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099368668328---5089976940.pdf In PDF document text
    • http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bf6a5ebe76---19480451144.pdfIn PDF document text
    • http://lbs.ac.at/wp-content/plugins/super-forms/uploads/php/files/a77m2d3cckcj0no5022706huk9/70511403855.pdfIn PDF document text
    • http://fabrykakonwersji.pl/wp-content/plugins/super-forms/uploads/php/files/a6fa593433d2251213f9f10646a4fde9/13094395357.pdfIn PDF document text
    • https://urbanplace.me/wp-content/plugins/super-forms/uploads/php/files/cbe14c5ef841fa54e21f5a389b3aded4/24592553101.pdfIn PDF document text
    • https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/6bbbdd63ad8729d2a73f5b0cd8225b0a/96238967491.pdfIn PDF document text
    • http://charivne.info/images/file/nurolaziburoji.pdfIn PDF document text
    • http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/16075e12b8dab8---garemedej.pdfIn PDF document text
    • http://4grd.com/cmsimages/file/zolozutom.pdfIn PDF document text
    • https://southernlightingsource.com/wp-content/plugins/super-forms/uploads/php/files/f452439cac02b5719bd7d889809009fb/jebinazimomit.pdfIn PDF document text
    • https://israelonthehouse.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093e7116f560---lijiteburazaneb.pdfIn PDF document text
    • https://truck-diagnostic.ru/wp-content/plugins/super-forms/uploads/php/files/816b385d880c1dda74dd3fb805ac8118/puzibis.pdfIn PDF document text
    • https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/46e2665d47d19e673a07980e3960ea15/lozibufidikov.pdfIn PDF document text
    • https://www.mybizwebsites.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a109fe8c60---92247988224.pdfIn PDF document text
    • http://www.alwaysflorida.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a61e979778---vuwolerijikakibezuxege.pdfIn PDF document text
    • http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160856db6e0832---23465686403.pdfIn PDF document text
    • https://alshamiltrading.com/alshamilfiles/file/42244208357.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=drive+intermarche+montendre+17130PDF link annotation
    • http://kioskcondoweb.wpengine.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071a1decdba0---92529534123.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d79d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD79D 5464 bytes
SHA-256: 9ad00148ad18d9955d5cdd9cafa3c59c0523df0ce4485c0ba1a238e667c814ec
font_01_sfnt_off0000ea1b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA1B 12276 bytes
SHA-256: 86c74c6c67c97e3f369548f561464f44e4967169792bef8b4f03deb9c3570db7
font_02_sfnt_off00011171.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11171 16204 bytes
SHA-256: 541fa2b6826b0add99b7d5a173ef1e6a5567607b5192f75b810eb17d6a563501

Open this report in the interactive analyzer, or submit your own file for analysis.