Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b667ee6814a33d9…

MALICIOUS

PDF

78.7 KB Created: 2020-11-17 21:26:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-17
MD5: 36a4c6ca507e07e42972a68b54fd0572 SHA-1: 49e703fe230d01fed8e82998f05a9d76123c279a SHA-256: 2b667ee6814a33d9778c5bf5fe472a4d63fa503876220e8c194f05adebcc1e2b
254 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/123?utm_term=key+concept+3.1+ap+world+history In PDF document text
    • https://gemenudotipetal.weebly.com/uploads/1/3/2/6/132695720/1092452.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370063/normal_5f9c6001bea72.pdfIn PDF document text
    • https://duxixujojive.weebly.com/uploads/1/3/0/7/130739103/dirilo_rodejipope.pdfIn PDF document text
    • https://wilujogid.weebly.com/uploads/1/3/4/3/134347442/dutodireb.pdfIn PDF document text
    • https://lesajevix.weebly.com/uploads/1/3/4/3/134318042/bejaxekuru.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/8cf11c0f-b5f4-424e-aa62-0bff710e6a0d/clifton_davison_dds_fort_collins.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/07a64a03-220f-4059-843a-aeb809a7e55e/25320957242.pdfIn PDF document text
    • https://s3.amazonaws.com/tonemakopinibem/vuvomivovu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b348ffa7-e4a1-4e5d-aad0-ab76c101cfd6/tesla_generator_blueprints.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/88f6fe89-aa6b-408d-93d6-c0ffaab051d7/sugovusuterez.pdfIn PDF document text
    • https://s3.amazonaws.com/bajuse/community_involvement_hours_log_sheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/af716fa0-b075-44b5-a675-fbd45ba0c89f/in_the_mouth_a_desert_lyrics.pdfIn PDF document text
    • https://s3.amazonaws.com/baxadelefofibuz/kedoboxulilo.pdfIn PDF document text
    • https://s3.amazonaws.com/metubevozisul/a_certification_study_guide_1001.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/57195258-5d02-4077-be8e-1786c2a81d2f/southside_concert_venue_pittsburgh_pa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d350.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD350 5572 bytes
SHA-256: b04fb69961748400e75af6536507417bd68e64de2adccbc5677e788e90fa4dbe
font_01_sfnt_off0000e666.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE666 2212 bytes
SHA-256: 0cb47c237e5c36f2cc889a8e42f7c9b0ce6a31ac4bdd2fcdb393e839dece8575
font_02_sfnt_off0000f07f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF07F 11356 bytes
SHA-256: 8aa639718c8db96e94e9cb9b7379029d7dfd07db51bea7a011782874d97c38ad
font_03_sfnt_off00011744.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11744 16036 bytes
SHA-256: 354dce64f07f3d7acdf6a04edf763950ffbfec4edcbb4bfe17b65a83544077bb

Open this report in the interactive analyzer, or submit your own file for analysis.