PDF malware analysis — malicious · f87c291374ed92e3

MALICIOUS

PDF

545.7 KB Created: 2022-01-28 10:49:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-17

MD5: 7aede409ff02f22d59e02bb548ce64b9 SHA-1: 1aa7c6e4fb988527bb8fa13239fc449b635ac128 SHA-256: f87c291374ed92e329888b9278462bfcc3a00cd8e05dc7661f8ba775eeee91fb

136 Risk Score

Machine Learning

Nyx PDF Classifier clean score 0.2150

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://fecuq.co.za/XSRYdR1H?utm_term=balarama+mayavi+pdf PDF link annotation
- http://bordahusfeldolgozo.hu/editor_up/sexibenodezabofetepiw.pdfIn PDF document text
- https://cmf8.ir/data/file/fibenakinapedo.pdfIn PDF document text
- https://biocoils.com/img/file/7873724200.pdfIn PDF document text
- http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/1616c0c87a4ea4---mojiduxirukazigaxuniwox.pdfIn PDF document text
- http://farmaciafici.com/userfiles/files/nafen.pdfIn PDF document text
- http://ikhmongol.mn/ckfinder/userfiles/files/vibumagogiwezitaw.pdfIn PDF document text
- https://aparcaderoshaddaichile.cl/uploads/images/files/23314760797.pdfIn PDF document text
- https://xn--hjrnskadeakademien-mtb.se/userfiles/file/semutip.pdfIn PDF document text
- http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161f33459121f3---84527498274.pdfIn PDF document text
- http://pjj.aoosung.com/upload/editor/file/85877171998.pdfIn PDF document text
- http://heorungminhphat.com/luutru/files/zesusijukiwovuwivo.pdfIn PDF document text
- http://itps-group.com/uploadfiles/file/sunivutid.pdfIn PDF document text
- http://bilateralmatters.org/userfiles/file/ruzodomara.pdfIn PDF document text
- https://www.reptrics.com/kcfinder/upload/files/11267529878.pdfIn PDF document text
- http://relaxzenter.com/uploads/files/bogiko.pdfIn PDF document text
- http://pachinkoevent.com/sites/default/files/file/dajatorezetizuzem.pdfIn PDF document text
- http://skidubravy.sk/spravca/ckfinder/userfiles/files/zobupujejawikokapawamex.pdfIn PDF document text
- https://rosenstein.lu/userfiles/files/mutoberewewi.pdfIn PDF document text
- http://www.groupkms.com/ckeditor/kcfinder/images/files/parokeworimawoxuxurujofar.pdfIn PDF document text
- http://p-itos.net/admin/userfile/image/file/74564507061.pdfIn PDF document text
- http://gazette.digifi.ca/newsletters//file/41354709441.pdfIn PDF document text
- http://alfavs.eu/userfiles/file/60606347393.pdfIn PDF document text
- http://recviem.ru/img/upload/wobuxobofib.pdfIn PDF document text
- https://groovinman.com/CWSAP/sites/default/images/file/zajadupu.pdfIn PDF document text
- http://vp-concept.ch/app/webroot/kcfinder/upload/files/sageminenalewutebavile.pdfIn PDF document text
- http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/33920f1e1843a9e3c60b77b5118bf2ed/68274253269.pdfIn PDF document text
- http://lisahyatthealth.com/wp-content/plugins/formcraft/file-upload/server/content/files/1616c55d3e0751---81565140782.pdfIn PDF document text
- http://mycoapaisyl.com/webimages/files/42151902149.pdfIn PDF document text
- https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/4fb79fd727be30150cd0141dc6305fc1/lipiz.pdfIn PDF document text
- http://bioengenharia.com.br/public/libs/kcfinder/upload/files/weginelugadalur.pdfIn PDF document text
- https://maydangson.com/vietkiendo/upload/file/25840312812.pdfIn PDF document text
- http://xn--k1akb4c.xn--p1ai/userfiles/file/tibijevulamadapexewogabux.pdfIn PDF document text
- https://cicadit.ro/UserFiles/file/kogiziv.pdfIn PDF document text
- http://hennel.hu/sources/elemek/file/tilaxipu.pdfIn PDF document text
- https://autopsrus.aerovents.com/ckfinder/userfiles/files/88027382138.pdfIn PDF document text
- http://sameiroeventos.pt/ficheiros/44250368825.pdfIn PDF document text
- http://www.onekaddy.com/wp-content/plugins/formcraft/file-upload/server/content/files/161dc7e30c8b2b---77000642023.pdfIn PDF document text
- http://lacasedescaraibes.fr/file/1475071155.pdfIn PDF document text
- http://npas.ru/pic/file/45582586886.pdfIn PDF document text
- https://pt2-turbo-j3t.com/contents/files/tiwavolamuvopibuvo.pdfIn PDF document text
- http://arredamentoambienti.it/img/file/zigokapuxugenaka.pdfIn PDF document text
- https://cecprint.com/images/file/94834097667.pdfIn PDF document text
- http://geometramaurotozzi.it/userfiles/files/83036514644.pdfIn PDF document text
- http://zeshengtecphar.com/UploadFiles/FCKeditor/20210929190112.pdfIn PDF document text
- https://raovat72.vn/uploads/news_file/64791229873.pdfIn PDF document text
- http://architettogherardi.eu/userfiles/files/42126430386.pdfIn PDF document text
- https://otdelkamos.ru/wp-content/plugins/super-forms/uploads/php/files/e167b151fd23dd6907c50bb72e4619ef/65421362726.pdfIn PDF document text
- http://cerrutistudio.eu/userfiles/files/3001934310.pdfIn PDF document text
- http://www.smpnuenen.nl/images/files/64128146865.pdfIn PDF document text
+9 more URL(s)

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00080618.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x80618	10268 bytes
SHA-256: `b3e103b79876ea497f16e55426fcdd7ab12be5418aff88814d2830475beca6f9`
`font_01_sfnt_off00081d2a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81D2A	2900 bytes
SHA-256: `49eb4421dd4b82acd90fd1c9831bacbb77a0005d4f6fcb6401f9d19282965464`
`font_02_sfnt_off0008297c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8297C	20612 bytes
SHA-256: `dcb570ad330aa38540061201fd9f89374049d7842cd8bea8663678e674c12aac`
`font_03_sfnt_off00085e7c.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x85E7C	16416 bytes
SHA-256: `cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336`

Open this report in the interactive analyzer, or submit your own file for analysis.