PDF malware analysis — malicious · 2b6cde47089b7bc1

MALICIOUS

PDF

71.7 KB Created: 2020-10-03 22:51:02 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-17

MD5: 3dd34e4b611e45f5bb480a65579f667b SHA-1: 0274c240c7c5792d7294559f1a79256db951ce1b SHA-256: 2b6cde47089b7bc1902be8f74fb54a970d4d39eb744dd2e540aba7452fbc7c0b

124 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/strik?keyword=capital+budgeting+techniques+solutions+gitman+pdf In PDF document text
- https://site-1039201.mozfiles.com/files/1039201/21182670802.pdfIn PDF document text
- https://site-1040297.mozfiles.com/files/1040297/88855861566.pdfIn PDF document text
- https://site-1036753.mozfiles.com/files/1036753/7134635918.pdfIn PDF document text
- https://site-1036885.mozfiles.com/files/1036885/9019346765.pdfIn PDF document text
- https://site-1037196.mozfiles.com/files/1037196/luvajefem.pdfIn PDF document text
- https://site-1037884.mozfiles.com/files/1037884/60998072153.pdfIn PDF document text
- https://site-1038796.mozfiles.com/files/1038796/begimate.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/987733e0-5ae1-46e2-9615-65c9ef50fd19/97383801583.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/14260e8b-308e-464b-b80d-e4fec349bd55/4967219606.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/86a47f04-c3f5-4d9c-ac0d-c68169967840/mivaxexurutin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/30db726c-54f9-4abf-aeb2-c9b52e166063/87835811421.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/92e0a66d-351f-49ac-a893-e8587ac0a843/77991414745.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a7cda025-4bd4-4135-9bf8-aef3ba91222b/75043142536.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ad012780-9203-4a04-8494-d6d43559b112/nunurixaleledagufovut.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b78b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB78B	5644 bytes
SHA-256: `0629e7efdb791391fedd22e72da43cb9deaa561e6d1ed7e8a3e5adcb2554b9a9`
`font_01_sfnt_off0000ca8a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCA8A	15708 bytes
SHA-256: `228e00776641523def14696ae07f49fddbf6709812b45940d52dc52c4b9d8326`
`font_02_sfnt_off0000fb95.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFB95	16248 bytes
SHA-256: `ba8ac12d832b88445aa45e131d5002554c158de8c28f0d15f04c1c9bc220467d`

Open this report in the interactive analyzer, or submit your own file for analysis.