Malicious PDF — malware analysis report

Static analysis result for SHA-256 3dd9b8387351d1a7…

MALICIOUS

PDF

38.3 KB Created: 2020-10-31 01:14:37 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-26
MD5: 286a3e63b3c26a7d107c9f85bd8c194c SHA-1: 983951202fe0e7c474095d60213c88131849d246 SHA-256: 3dd9b8387351d1a792ffdeeb56e89a2fb9627e1acf2a8143e7948c32132005ee
184 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/wb?keyword=paroles%20de%20l In PDF document text
    • https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/kopiwu_gotatumeturi_bovejixegas_vivikow.pdfIn PDF document text
    • https://disaxugotusineg.weebly.com/uploads/1/3/1/8/131871710/1882730.pdfIn PDF document text
    • https://xawuwotogot.weebly.com/uploads/1/3/2/6/132695388/vasekere.pdfIn PDF document text
    • https://zemuxarasojutin.weebly.com/uploads/1/3/4/3/134374283/9185041.pdfIn PDF document text
    • https://mogezisatizate.weebly.com/uploads/1/3/0/7/130775403/vuwisutek.pdfIn PDF document text
    • https://nobinetezo.weebly.com/uploads/1/3/0/9/130969761/tidevi-muxajamireja-jilatudiwixa.pdfIn PDF document text
    • https://miwilokak.weebly.com/uploads/1/3/4/3/134375457/kowurukofoxalemomo.pdfIn PDF document text
    • https://lipowuripipu.weebly.com/uploads/1/3/1/3/131378852/97c11073a5f.pdfIn PDF document text
    • https://jumuwubugunitus.weebly.com/uploads/1/3/1/0/131070493/2261240.pdfIn PDF document text
    • https://koxabiwepa.weebly.com/uploads/1/3/4/3/134309970/xediboginudalu-kanizikul-naweliwek.pdfIn PDF document text
    • https://suvejuxib.weebly.com/uploads/1/3/4/3/134380783/516928.pdfIn PDF document text
    • https://zodovamerevi.weebly.com/uploads/1/3/4/3/134316438/971841.pdfIn PDF document text
    • https://vaxonarug.weebly.com/uploads/1/3/4/3/134378521/03072d3ad5d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/112ef9f7-5ba3-4744-b0d5-1e2e44c04563/39586085615.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/48b80d08-ba12-484f-801b-03becdc3af03/gumabaregexulozepilanoxib.pdfIn PDF document text
    • https://s3.amazonaws.com/lixuduwonifa/boy_sports_watch.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005350.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5350 5288 bytes
SHA-256: dd4a3003a0b9b3af1a2fd4915e3091e1f4a12732c9a21b522c9c1f16cda3308a
font_01_sfnt_off00006559.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6559 11380 bytes
SHA-256: 39bef3075b7e1f21c4d91fe580c2256b68e9aa51244b2d3c8734b24bc2f65512

Open this report in the interactive analyzer, or submit your own file for analysis.