Malicious PDF — malware analysis report

Static analysis result for SHA-256 08ade5f3e91c773a…

MALICIOUS

PDF

145.7 KB Created: 2021-03-14 07:17:18 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 0e9c36af33b33b03e259764ddb7a9ae0 SHA-1: 5bec2c16b75013ace36aca2d80155bd859769940 SHA-256: 08ade5f3e91c773a3fb8c5a67df5a830672b1f7a31f5e84352763937caac6c14
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Machine Learning

  • Nyx PDF Classifier malicious score 0.9970

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=blue+rage+black+redemption+pdf In PDF document text
    • http://pro-komp-master.website/how_to_come_up_with_a_title_for_a_romance_novelw713y.pdfIn PDF document text
    • http://jimubezisu.iblogger.org/informing_employer_of_pregnancy_letter_template.pdfIn PDF document text
    • https://cdn.sqhk.co/fapewejav/hLjdIhd/godokij.pdfIn PDF document text
    • http://instas.site/koxotefonavesibgqk.pdfIn PDF document text
    • http://bosnoslovnoejelaniekupit.xyz/vararusolajumk57ed.pdfIn PDF document text
    • http://deflecfcvy.best/lalitha_sahasranamam_phala_sruthi_meux0jl.pdfIn PDF document text
    • https://cdn.sqhk.co/vekasurox/Edhcv4f/telidagejagalilowigefo.pdfIn PDF document text
    • https://cdn.sqhk.co/dewufidabo/egiifja/gta_san_andreas_extended_gang_war_mod.pdfIn PDF document text
    • https://cdn.sqhk.co/bulegumu/0igpJgt/ayyappa_music_ringtones_free.pdfIn PDF document text
    • https://cdn.sqhk.co/vixokezafafu/ja6iXhf/suguwilegoredapox.pdfIn PDF document text
    • http://komarovskii.xyz/quantitative_trading_systems_2nd_editionqj18q.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vaterojot.epizy.com/antidiabetic_drugs_chart.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/73382bff-1d03-431d-ad30-b2305c27c07c/53173023909.pdfIn PDF document text
    • http://wudobew.epizy.com/busybox_pro_apk_cracked_free.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81e33b61-9769-4ab7-995a-e28b941bcf1c/73518655851.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2c092066-65ea-464d-915f-28b9327e909b/80733921608.pdfIn PDF document text
    • http://pivasif.rf.gd/78066172391.pdfIn PDF document text
    • http://xugivazule.rf.gd/88637164619.pdfIn PDF document text
    • http://xokesuluz.epizy.com/rokasexuraratapupuwe.pdfIn PDF document text
    • https://832c8a8d-f05d-46e3-9166-97d9de82ace4.filesusr.com/ugd/432509_d22618a756e549c2acdf887c81296e3f.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa8fecad-58c3-40f5-8a76-df658c3027b9/tusibugugetesal.pdfIn PDF document text
    • http://lasuwutiganije.rf.gd/panasonic_bread_maker_sd_253_manual.pdfIn PDF document text
    • https://467375c7-a7a6-4806-a9b7-892c2a528f89.filesusr.com/ugd/911174_4789dd8f963a4d94b6d56d79b1688cd4.pdf?index=trueIn PDF document text
    • https://0e818273-c791-4c7a-b20f-750474b78fe4.filesusr.com/ugd/362633_c904fe671a874a24aef9f5e6e876d0bd.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001e968.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E968 5548 bytes
SHA-256: 46831e1719b45fc81831b8c5ebdfd5536345241d48b30692117034b6331ec98a
font_01_sfnt_off0001fc36.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FC36 11720 bytes
SHA-256: 16513b498eeaba53c6f8e3d27e16161a27a5636c9734e6bc0faae162cbe07303
font_02_sfnt_off00022386.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x22386 16060 bytes
SHA-256: 660d05b38fea380e8cc13f4a5a7db764e9bd2a20a73145a73af50c118749f22b

Open this report in the interactive analyzer, or submit your own file for analysis.