PDF malware analysis — malicious · 4e3a2608935e6f0b

MALICIOUS

PDF

42.3 KB Created: 2020-11-09 03:27:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-19

MD5: 7e20c2107bdd20cc0107ecf7d81e1ba0 SHA-1: 9597bc03ca7d822a97ad2411b8a2a5255b4b3b4c SHA-256: 4e3a2608935e6f0b45144450ef599fcdcf00ebd927062d340a3ec3265c253d45

66 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://trafffe.ru/wb?keyword=trustfire%20charger%20manual PDF link annotation
- https://ludasajuwo.weebly.com/uploads/1/3/4/0/134096591/9943558.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4419211/normal_5f9b6dc08d0a3.pdfIn PDF document text
- https://jewajufigojoxi.weebly.com/uploads/1/3/1/4/131438211/65fd2b.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/429c4e40-27fd-4d2f-a988-c7a95d9ce908/73029531306.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/797bff5b-d4e2-495e-979d-995c9fae99eb/60774952057.pdfIn PDF document text
- https://xoxuwenixage.files.wordpress.com/2020/11/18827254971.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5f2138e6-e9ad-4402-838d-80d53661770f/34849324643.pdfIn PDF document text
- https://zojemadej.files.wordpress.com/2020/11/73587489466.pdfIn PDF document text
- https://s3.amazonaws.com/vedexajawo/massillon_cable_tv_channel_guide.pdfIn PDF document text
- https://s3.amazonaws.com/tetazino/unlocked_movie_2017_cast.pdfIn PDF document text
- https://ribowazakas.files.wordpress.com/2020/11/45533864489.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7729cb78-2be6-4757-84c1-f1eed25e5329/friv4school_2018_minecraft.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006573.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6573	5244 bytes
SHA-256: `882df816183507feeb25ddf30b195886c8378d6fbd4896001353864dc350debf`
`font_01_sfnt_off00007722.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7722	11192 bytes
SHA-256: `98c0236f3950cc462260c269452f88da0418bc1997bf7feb5ee39a0d66fa47f9`

Open this report in the interactive analyzer, or submit your own file for analysis.