Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d30ebe27392c50e…

MALICIOUS

PDF

46.8 KB Created: 2020-11-08 16:21:31 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-14
MD5: e4ff790633640475095044a48b8ae454 SHA-1: 89a546e6b8ec434b3d1dce322b196a1ff5e8733b SHA-256: 0d30ebe27392c50e98a6b604d0d14de79995be1cdb2712d12c2b0ce9678617d0
66 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffset.ru/wb?keyword=hexes%20and%20jinxes PDF link annotation
    • https://sabovewedasujak.weebly.com/uploads/1/3/4/4/134493104/7208139.pdfIn PDF document text
    • https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/1109957.pdfIn PDF document text
    • https://sozivutapadonen.weebly.com/uploads/1/3/1/1/131164462/7901005.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4413008/normal_5f9705ee9c30f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4408324/normal_5fa62e2fa969b.pdfIn PDF document text
    • https://ronumotesagazuw.weebly.com/uploads/1/3/4/3/134373959/723be5e9f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4378383/normal_5f89fc49df52d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://zitatotifewe.files.wordpress.com/2020/11/89388487589.pdfIn PDF document text
    • https://zivujege.files.wordpress.com/2020/11/2878917950.pdfIn PDF document text
    • https://vexuxab.files.wordpress.com/2020/11/cyber_security_and_law_notes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0748da61-6049-4bf9-a39b-0375295234f0/home_decorators_collection_faux_wood_blinds_corded.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bde59d39-415a-4ddd-b2f8-059490ec1fd6/4_hour_chef_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70c6e85f-470c-4b48-bca9-22d7b25bf186/6382588800.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4a92007c-10d6-41fe-934c-15cb21c61be6/minecraft_1.14_apk_pe.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006bdd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BDD 4392 bytes
SHA-256: 69108fd20eec6ce005f0bf89e66606b0b75b4ca7e557963be7278fadca7f7f80
font_01_sfnt_off00007ac4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7AC4 11140 bytes
SHA-256: 0022abe9cd1653eecf1a8a186330c8fa6f3b2df3a0d0092920bf09c7c8e67106
font_02_sfnt_off0000a04e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA04E 4324 bytes
SHA-256: cd94ef65598b1866d0653cdd88243d989fd81359c0e770c2d3a4858f1c2f6d34

Open this report in the interactive analyzer, or submit your own file for analysis.