Malicious PDF — malware analysis report

Static analysis result for SHA-256 478370860b6ffa65…

MALICIOUS

PDF

71.3 KB Created: 2020-12-22 13:26:08 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-20
MD5: ccac02f53902281bc78c1d691571915b SHA-1: 9ab7b855b9cd159bc36f15d3d69024ab8d37f9cc SHA-256: 478370860b6ffa6546a9dcbe9b77c067f9b2d83730ad1a0823bb5f2b81ab41da
196 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?utm_term=muslim+mosque+inc PDF link annotation
    • https://kupanonul.weebly.com/uploads/1/3/4/6/134682697/duvijodetan.pdfIn PDF document text
    • https://xonedapu.weebly.com/uploads/1/3/4/6/134654428/9805275.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374002/normal_5f9c26f0b6d43.pdfIn PDF document text
    • https://mejotumuv.weebly.com/uploads/1/3/4/6/134636951/359a025d03.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403130/normal_5f9b9a3335aec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366653/normal_5fc2dc155255c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369651/normal_5fb8a892e8a3f.pdfIn PDF document text
    • https://jefogozadiz.weebly.com/uploads/1/3/4/0/134040800/853026df1ee0c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4375342/normal_5fa655682f9e4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc6b266bda9c57a97e6b58e/t/5fcb2f54a51c5a1401a5c3ba/1607151444848/nulikifel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6c4d758c-76c9-43b1-9534-8b877796238b/satamasipufap.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce685156cd0c1ac38a485c/t/5fd6deb6164d0f203c8ea2a9/1607917239438/audit_report_of_listed_company_2018.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc17dd3405d5340f32dc63c/t/5fc2c54f08845d0924e52d6a/1606600015335/sklz_pitchback_instructions.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1175aa879396864096daa/t/5fc8ad56f97c193540f57ec0/1606987094293/dr_rahman_chessington.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2a4258cd-a90a-4f73-8a42-e2221fb0dcc4/mekavoxad.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5909340f1034a5cc888ef/t/5fcc35b76f0099009e55b27f/1607218615875/82450981761.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fce2e950db0542b884e5bbd/t/5fd6895f72b1137fa97c475e/1607895391390/malformaciones_congenitas_del_rion.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000db80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB80 4768 bytes
SHA-256: ad2e68fffa7c96733e1e2ffcd6a74219ac10663aa9d056df3bc379153c968209
font_01_sfnt_off0000ebbb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEBBB 10916 bytes
SHA-256: 82980ccaa622f8e8501add4a6fcd946596de47921a9115a98e328c6d80dd1a41

Open this report in the interactive analyzer, or submit your own file for analysis.