Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e3da12d47155ed7…

MALICIOUS

PDF

45.4 KB Created: 2020-10-08 17:31:55 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-19
MD5: fd54a9b6c4c03df380e9607c99b7725b SHA-1: a21f4b9ebb53f431cae41a91135551c58fd82f32 SHA-256: 4e3da12d47155ed73e5d2d967654312c1e18d9b880d8b69bb07794511501170e
134 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=wondershare+filmora+mac+10.10.5 In PDF document text
    • https://site-1040171.mozfiles.com/files/1040171/29709730015.pdfIn PDF document text
    • https://site-1043175.mozfiles.com/files/1043175/gelonobu.pdfIn PDF document text
    • https://site-1037914.mozfiles.com/files/1037914/mijegikifamefereji.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/34b95dc6-a8a6-4a49-b6a7-7e8733ad8e80/39326255964.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/662155a4-4cec-46e9-b2ad-87b2c1320b92/10808926881.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b1899730-d09a-4d54-a427-239cc9cd23c7/famodo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5f9d3a3-3d2c-4387-a5b9-7041a28af5cf/92790936314.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2886c362-ec8a-4f3e-9c0e-02b2ac7bf372/36741637630.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/53e0477b-8e2b-42f5-aee1-c145cb6bf298/15594405959.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/45d73ff0-a867-4f07-b8de-28e822294b9c/vepug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f7715830-406e-4300-9046-8cc9d89d1b5c/begugivuporivumokav.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bd3edfe8-fe25-4ee8-b2eb-05f37762db2a/83248550469.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a7d4bd0-e676-41bc-8d5b-384ed3561e46/majosewozukurotuxelomobad.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005d63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D63 5332 bytes
SHA-256: 92d95fbf466c947cffdad07f75c02c8add6265e119239a09841397352c115abf
font_01_sfnt_off00006f61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F61 13740 bytes
SHA-256: 43d000c95b821fa5076485daf6397e780ea8e4ad0e19b7f32abb98a2b4859f33
font_02_sfnt_off00009a9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9A9D 4324 bytes
SHA-256: d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378

Open this report in the interactive analyzer, or submit your own file for analysis.