PDF malware analysis — malicious · f99488b3c29d4981

MALICIOUS

PDF

222.0 KB Created: 2022-03-29 00:51:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 5.11.3) First seen: 2026-06-13

MD5: 7783b753215d96dd9883e9a4de31cee6 SHA-1: ca06ab395f07a41afa3cc74053e042bd7b01636b SHA-256: f99488b3c29d4981582202eee902f245cc0afacb936923cd2a403969c84b676d

174 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 0.7225

Heuristics 7

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM

PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yubit.co.za/XSRYdR1H?utm_term=leaf+bladed+spear+osrs PDF link annotation
- http://www.bash.cl/media/file/7926047635.pdfIn PDF document text
- https://www.aukuras.org/ckfinder/userfiles/files/xukiramabiliwigumep.pdfIn PDF document text
- http://glearningsolutions.com/userfiles/files/waminopowabusapirizoxijup.pdfIn PDF document text
- http://www.bennex.co.th/assets/kcfinder/upload/files/gututogetitatetajidisav.pdfIn PDF document text
- http://etiquettes-adhesives-bobine.fr/kcfinder/upload/files/51954035075.pdfIn PDF document text
- http://alpha-th.com/userfiles/file/39381889717.pdfIn PDF document text
- https://unecol.com/uploads/kcfinder/upload/files/mejuk.pdfIn PDF document text
- http://thumuavechai.com/vietkiendo/upload/file/55568997364.pdfIn PDF document text
- https://oneremote.ru/wp-content/plugins/super-forms/uploads/php/files/f4a2a2760ddab2985a5c0c56fd5f1e50/69798200675.pdfIn PDF document text
- https://producedepot.us/userfiles/files/76077511887.pdfIn PDF document text
- https://rumahbaruku.com/contents/files/sorikepapofulumifizubiris.pdfIn PDF document text
- https://trungtammaychieu.com/ad-min/js/libs/kcfinder/upload/files/tezabamanovoletotam.pdfIn PDF document text
- http://canxetaianhduc.com/images/file/44970072985.pdfIn PDF document text
- https://intelean.com/wp-content/plugins/formcraft/file-upload/server/content/files/16201d907c4b3c---mozokogejerekobuvujexo.pdfIn PDF document text
- https://swotin.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622ada4a6f067---jimofol.pdfIn PDF document text
- https://detectagsafety.com/ckfinder/userfiles/files/50093833271.pdfIn PDF document text
- https://msiutilities.net/documents/tufatoset.pdfIn PDF document text
- http://www.acs-pack.fr/kcfinder/upload/files/80156226339.pdfIn PDF document text
- http://prabashproperties.com/ckfinder/userfiles/files/nakofadi.pdfIn PDF document text
- http://www.thebetterinsurance.com/wp-content/plugins/formcraft/file-upload/server/content/files/16201c5af98842---43243520856.pdfIn PDF document text
- https://copperscraphandlers.com/ckfinder/userfiles/files/zapokiwebirixubewixibig.pdfIn PDF document text
- https://robustbrakes.com/administrator/imagetemp/file/18643186958.pdfIn PDF document text
- https://nnkcreations.com/userfiles/file/99221622549.pdfIn PDF document text
- http://lafedja.cz/public/file/62513726070.pdfIn PDF document text
- https://nieruchomosciprzetargi.pl/files/file/62616918788.pdfIn PDF document text
- https://topas-septiki.com/media-temp/img/uploads/files/69265072401.pdfIn PDF document text
- https://expomediainc.com/upload/file/zadadad.pdfIn PDF document text
- https://emenu.hu/editor_up/74658362174.pdfIn PDF document text
- http://gradn.ru/uploades/fckeditorfile/41011800337.pdfIn PDF document text
- https://implantsdentairesdesmoulins.com/upload/editor/file/ronaxewixedisekofalubari.pdfIn PDF document text
- http://www.satunatc.ac.th/ckfinder/userfiles/files/mavinir.pdfIn PDF document text
- https://kameno.bg/userfiles/files/70080444028.pdfIn PDF document text
- http://www.casopisfolklor.sk/assets/kcfinder/upload/files/xopawotunaza.pdfIn PDF document text
- http://mrpennarak.com/user_file/file/nijoximufiv.pdfIn PDF document text
- http://rdasesores.gestconcursal.com/editor/ckfinder/userfiles/files/bepamobukisolerufoxexub.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0002edd0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2EDD0	16560 bytes
SHA-256: `924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9`
`font_01_sfnt_off000304ea.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x304EA	16220 bytes
SHA-256: `207eb3b51995adbdef2a766e0364e2c2ee182a7f0f0647c12a4a3807efc046f6`
`font_02_sfnt_off00031acf.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x31ACF	10292 bytes
SHA-256: `9a1768bdaef08662ae434cff34e1859053ccefd2c09c403f2e708a9be9a8458e`
`font_03_sfnt_off000331db.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x331DB	19984 bytes
SHA-256: `835c7e1c01a9fcf069eff7ad9de1a0d70b91c711d0e9c05bccf3d0c30f53f332`

Open this report in the interactive analyzer, or submit your own file for analysis.