Malicious PDF — malware analysis report

Static analysis result for SHA-256 42538f3b17faff7b…

MALICIOUS

PDF

43.2 KB Created: 2020-10-24 01:52:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-15
MD5: 38d6ca10d3d0cc1ee9e3b854111b0a42 SHA-1: 9cc9d8499e7fcf1ca6c243e07efd4111b20f8450 SHA-256: 42538f3b17faff7ba0677e88d3205a5ae262a5cf63faeb2a08c99d5a78007d1d
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cctraff.ru/wb?keyword=computer%20science%20an%20overview%2012th%20edition%20brookshear%20pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4369654/normal_5f92140839232.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367959/normal_5f87569e96cfe.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379234/normal_5f92ab12d58e8.pdfIn PDF document text
    • https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/xenemavurinap_jokepirewiteda_fijalezej_gemewije.pdfIn PDF document text
    • https://xumusiroti.weebly.com/uploads/1/3/4/3/134321309/759245.pdfIn PDF document text
    • https://muxoramosuzuveg.weebly.com/uploads/1/3/4/2/134266249/746c61547cf9.pdfIn PDF document text
    • https://xifobosakup.weebly.com/uploads/1/3/2/8/132815359/negejenuxu_fubomudozapaxon.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/304126df-06ba-42d0-b78c-59228997beef/nioh_dual_swords.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6c231fb-4b0b-4a0e-9baa-3b767c0221db/foniliferezuvodutoxesiwu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/de5701c6-9e83-44a9-8518-c6de95d93530/89782381336.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/5328/4008/files/diabetic_ketoacidosis_nice_guidelines.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/8556/0506/files/download_uc_browser_apk_for_windows_10.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/3739/1510/files/98830098619.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c7e97fa-cc30-447d-910e-bfa833c60e91/somewhere_over_the_rainbow_piano_sheet_music.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/64b55ccf-03c5-4fcc-9b5f-837b24ec1de5/vudeburagesuko.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e3ca81e4-0bc3-4e4f-9aaa-b7bce4c249c5/buresizidok.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1693ba1b-061b-4ccb-be74-086d93bf6283/pafumikanujepepala.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77ce5cb6-66b3-4f6e-9ad2-2734d2e53161/55538015607.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f628093d-1c5d-49d6-a204-ac56105cd760/zapugixejabuvakibob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d946eb0-5291-425f-9e9d-a67958fe545a/pemorikadovamalaj.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/94edbc9b-8480-4727-baf1-b9a952e99699/vemedapiwetadate.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x66AA 5808 bytes
SHA-256: afbf9a8770265dd8f00b05c485161ac7dcd58d7e2f5baeb784013044029de5ff
font_01_sfnt_off00007a54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A54 11136 bytes
SHA-256: 33b4a83bd85cb8680b47cfadcca542be4a1e583f96e911275e2dd52726f14b2c

Open this report in the interactive analyzer, or submit your own file for analysis.