Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfa9ae63e333ec34…

MALICIOUS

PDF

97.1 KB Created: 2021-06-27 10:23:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-05
MD5: a6be0fe8e3fc5233d6112459e2d3bad0 SHA-1: 6f1d87938fe7d4a0a47dca7cf280c833d4afa3be SHA-256: dfa9ae63e333ec3480d5f4f9177c15326d29e0685cf43c522c750660bd85ce9a
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and is flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. The heuristic 'SE_CALLBACK_LURE' indicates the document's content is designed to trick users into calling a phone number, a common tactic in tech-support scams and callback phishing. Although no scripts were explicitly extracted, the presence of numerous external links suggests a potential for downloading further malicious content or redirecting users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9937

Heuristics 7

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
    PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://inwebjor.ru/uplcv?utm_term=blood+capillaries+that+supply+the+epidermis+are+located+in+the PDF link annotation
    • https://www.tifdip.com/wp-content/plugins/formcraft/file-upload/server/content/files/160850775caf84---fukexumaj.pdfIn PDF document text
    • https://istanbularicilikfestivali.com/upload/ckfinder/files/29511062662.pdfIn PDF document text
    • http://kino-profi.com/wp-content/plugins/super-forms/uploads/php/files/262661df700a198a5be4671d3fc53aa1/purox.pdfIn PDF document text
    • https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/160adcf6ab0b4d---wikowarumolobadopetob.pdfIn PDF document text
    • http://www.ebsjosepirosamaria.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609441b46b7d1---98445579471.pdfIn PDF document text
    • http://humanitool.ru/userfiles/file/pipalupimetu.pdfIn PDF document text
    • http://infrabud.eu/fckpliki/file/fawotopavuwajetosabe.pdfIn PDF document text
    • http://hilimall.ae/uploads/files/72416876418.pdfIn PDF document text
    • http://www.viksexteriors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc66a2f82e---55027436462.pdfIn PDF document text
    • https://ethiquedevelopers.com/wp-content/plugins/super-forms/uploads/php/files/ea4e0599e50363cd6d0f107bb5031f02/beronef.pdfIn PDF document text
    • http://hzjksj.com/images/upload/File/46646059910.pdfIn PDF document text
    • https://limpjet.com.br/wp-content/plugins/super-forms/uploads/php/files/e143e07483f48a5a87a23b27ee7b5ac0/sawogutiwuzaxalelo.pdfIn PDF document text
    • https://smoothnomad.com/wp-content/plugins/super-forms/uploads/php/files/vvvpb87tmuvktph1m4q0or7mjd/91770575422.pdfIn PDF document text
    • http://www.atrium-tuiles.com/wp-content/plugins/formcraft/file-upload/server/content/files/160708aef79eb8---sesejukopolovul.pdfIn PDF document text
    • http://sushi-belovo.ru/files/fowuwuxudawewupuga.pdfIn PDF document text
    • http://www.nandomoraes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c08341eca06---weribesazesuxikebujez.pdfIn PDF document text
    • http://location-appartement-venise.com/italie_documents/files/65050033578.pdfIn PDF document text
    • https://careersourceokaloosawalton.com/files/public/mopujobaputeket.pdfIn PDF document text
    • https://ateneoarbonaida.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a55bf5e03b7---zetozojub.pdfIn PDF document text
    • http://www.sparkprototypes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f24f555873---55011081992.pdfIn PDF document text
    • https://regeneracion-capilar.com/wp-content/plugins/super-forms/uploads/php/files/4fa021f3ef7c33c78c4b4ca5306974ea/diwipenunomogil.pdfIn PDF document text
    • https://deedpoll.sg/wp-content/plugins/super-forms/uploads/php/files/934195a3ca8e98d9f24782aed6cc4527/90663695953.pdfIn PDF document text
    • https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/e0nt65epehupou2t18omp7it54/riminutonipopakodixese.pdfIn PDF document text
    • http://domeinbeverdonk.be/assets/files/file/41007244701.pdfIn PDF document text
    • https://prsnashville.com/wp-content/plugins/super-forms/uploads/php/files/2dc4ef1e673370a8447dda604809db57/ginejolifeluzonet.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011782.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11782 11044 bytes
SHA-256: a63ad208130eaad0add5f3ee59266cac8abd1598db2ec2af9d6db74b73a736bb
font_01_sfnt_off00013118.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13118 16792 bytes
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1
font_02_sfnt_off0001492a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1492A 16780 bytes
SHA-256: dc7db351e7c8e175523b22b265a2cf2726863b884dba9ad2d46768ef2c8bcf9d

Open this report in the interactive analyzer, or submit your own file for analysis.