Malicious PDF — malware analysis report

Static analysis result for SHA-256 695032c1c16afb71…

MALICIOUS

PDF

166.3 KB Created: 2020-09-17 00:23:44 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-07
MD5: 02b11c35eb7b6a568594d089dce9d0f0 SHA-1: 90022a79c267af5d69f03cf455c4b420cf32508e SHA-256: 695032c1c16afb7168e6d690220fbdf14947db271a17a532f2e299537cc84719
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which is identified as a malicious redirector. The document body, though heavily obfuscated, also contains a URL that matches the malicious redirector. This suggests the primary purpose of the PDF is to lure users to a malicious website, likely for phishing or scamming purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=star+arcana+persona+3+portable+male In PDF document text
    • http://rejijed.art-of-rude.com/uploads/1/3/2/7/132740292/dafurebuxularovug.pdfIn PDF document text
    • http://fubafapax.malcolmmacdonaldoutlawford.com/uploads/1/3/0/8/130813829/1007337.pdfIn PDF document text
    • http://files.ottaart.com/uploads/1/3/0/7/130775516/8339e035cdca86a.pdfIn PDF document text
    • http://files.lougiansante.org/uploads/1/3/1/4/131453124/jeraretet.pdfIn PDF document text
    • http://files.waltshotrodshop.com/uploads/1/3/1/4/131453348/1867429.pdfIn PDF document text
    • http://fizoroti.andreavargasportfolio.com/uploads/1/3/1/3/131384635/sojuzelukuge.pdfIn PDF document text
    • http://files.manikkrealm.com/uploads/1/3/0/9/130969206/2924324.pdfIn PDF document text
    • http://files.vacworld.net/uploads/1/3/0/7/130740458/luralebiwum.pdfIn PDF document text
    • http://files.artofmichaelnguillen.com/uploads/1/3/0/9/130969811/42f9f.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://98ba7302-872c-4e9b-8acc-655765f0a63f.filesusr.com/ugd/ac8c68_a28e55d97eee464f8b15f8fb60bbbc06.pdf?index=trueIn PDF document text
    • https://266090ff-a053-42e4-a15a-d83395ba3d3f.filesusr.com/ugd/fe83c3_b9965e83d790445fba30e9d45a5cf388.pdf?index=trueIn PDF document text
    • https://f0218d1e-607e-4bec-b981-a1dd78d2cee1.filesusr.com/ugd/4bb894_8bd37692371744afb278a6cc398697f3.pdf?index=trueIn PDF document text
    • https://b93aa6cc-4c7f-4817-b466-2ee927b19e9a.filesusr.com/ugd/3826db_7e2101f8cfb5454791131afa3e817558.pdf?index=trueIn PDF document text
    • https://dc5e0ae5-8e7e-4120-bfed-b22d97f5f1ad.filesusr.com/ugd/ca32a8_f8c4c2a7714d4194b392d78d1b3cd519.pdf?index=trueIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5486/6333/files/capacity_assessment_form_2.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/2829/9428/files/python_language_pdf_file_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/0433/6040/files/piraf.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/7143/9001/files/gta_san_andreas_pc_cheats_txt.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000184d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x184D7 69320 bytes
SHA-256: b38f72f1aea5247f92699d0c56d5cbce39449a927ac185342003cbcbc82be127
font_01_sfnt_off0002542d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2542D 5484 bytes
SHA-256: 0953a2ce5ca98c736ac4e8c6538f9516527e7d30a4a511ce42bcd8cfaa7977d9
font_02_sfnt_off000266b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x266B6 10624 bytes
SHA-256: fa61899f45884660a1e86ea82794ddcee242a1824b19eee0201556c9558549b3

Open this report in the interactive analyzer, or submit your own file for analysis.