PDF malware analysis — malicious · 5d8e4b8dce0c7fe5

MALICIOUS

PDF

52.8 KB Created: 2020-10-17 01:45:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-18

MD5: 317a28881057fbb189f3d651c3eb9e2b SHA-1: 3f9bc529f0d9a97eef2fc4568e26b1f3e9bb33d1 SHA-256: 5d8e4b8dce0c7fe5ec03299466225f5f2fc916e950e988db2183c99d51b974ec

194 Risk Score

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 5

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/123?keyword=boilers+types+characteristics+and+functions+pdf In PDF document text
- https://nudojafobedem.weebly.com/uploads/1/3/1/3/131379550/5544981.pdfIn PDF document text
- https://gaxopekel.weebly.com/uploads/1/3/0/9/130969853/8778021.pdfIn PDF document text
- https://nitetezelimon.weebly.com/uploads/1/3/1/4/131438651/bubirisonisa_fedanalesi_fikafugegira.pdfIn PDF document text
- https://ditiwudo.weebly.com/uploads/1/3/1/4/131452947/felow.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366063/normal_5f890253a1fa8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367667/normal_5f87611ad7c90.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369904/normal_5f8862bc5f39c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365547/normal_5f86f603de166.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366015/normal_5f895414dc25e.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366628/normal_5f872e902cb36.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4365659/normal_5f870132d11c6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367922/normal_5f8a13b89b87a.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://cdn.shopify.com/s/files/1/0496/8113/7821/files/nuclear_reaction_worksheet_answers.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0500/1075/1126/files/bsp_thread_chart_with_drill_size.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0436/2865/8848/files/nueces_county_district_clerk_property_search.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0428/9026/4742/files/short_i_words_with_blends.pdfIn PDF document text
- https://cdn.shopify.com/s/files/1/0482/9967/1714/files/why_computers_process_data_in_binary_format.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d73646d3-8cb8-4806-9d20-54624bb21b8d/dovonexotixesadonuv.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/93638f9b-e224-410b-9363-a5f141f3dac2/50653755025.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7e896dce-61cc-40ff-bacf-31d66fefc44e/bewawin.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/af73d97d-bf80-4eb9-b4c1-eb3c3b345b36/77553614600.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/6fd1683e-cf82-4fa4-9e7d-fb6fb0b96305/8293736874.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000081c5.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81C5	5276 bytes
SHA-256: `ec79c2a9344581c588e3a3d129b8fcb00d98c9ae3b3040ef2a5d1e043a62201f`
`font_01_sfnt_off000093a9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x93A9	10420 bytes
SHA-256: `e27fb8456088bd52ea4f489f65ebcac6b7e23ac90c888e816601b5d502daaca2`
`font_02_sfnt_off0000b714.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB714	4324 bytes
SHA-256: `1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e`

Open this report in the interactive analyzer, or submit your own file for analysis.