Malicious PDF — malware analysis report

Static analysis result for SHA-256 782a111db8a5c91c…

MALICIOUS

PDF

86.4 KB Created: 2020-10-17 04:45:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-16
MD5: f505129891c2b913fb771990f5a80085 SHA-1: edcd86deac16999359df7165ae45be5f1b3c7494 SHA-256: 782a111db8a5c91c5c607b6d0a95edf05f83545ac2874c67031691a207567a5b
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/strik?keyword=welcome+to+dead+house+story In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366357/normal_5f877294847f4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366028/normal_5f89fbeaea278.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/1090e3c1-d449-4c34-bf34-0c68c557f34e/wivijibefebunokaxis.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/51093198-6f7a-43d3-a8b7-4ec9fcac70ad/18734089741.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4867365e-3e97-4126-884d-e9c5659bc51e/lumubedanag.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa0153ee-ad16-4aae-96a4-d25a7530c09f/77144680986.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/1485/6610/files/2888351168.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/4997/4946/files/redulanamipekusepoze.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0497/9189/3666/files/26675034247.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e114005b-2d14-43cb-93ba-965fdc98c1d3/zuzewatuxuzurugefeminigoz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/90e4c6db-55ab-4d0f-a2e0-4d5d5e553111/56009030830.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0268/8211/3728/files/hello_world_program_in_kotlin_android.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/8187/5112/files/lunumurenilinunav.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0492/5797/1868/files/seventh_chord_inversions.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0495/6569/6152/files/los_trabajos_de_persiles_y_sigismunda_summary.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/9006/0473/files/monkey_madness_1_osrs_guide.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b8053cb0-3898-43b5-8989-296ea51b1ddb/bavipuzepezili.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8067fbc8-2fd4-4355-a42b-dc76c37293bb/99547465116.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/65f37293-efb6-4595-8241-9d60079519bc/30705481311.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ade6c1e4-7201-4244-9514-0065fa27c9a2/vomujujorekiwugod.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011356.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11356 5292 bytes
SHA-256: 235980859b718baa677566134aaa45b9758ec5922e68a7f2171e8fc9f9b3438a
font_01_sfnt_off00012537.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12537 11268 bytes
SHA-256: e6f34a3e6e2d08b15e538086703add54cdd1693c5ba5aaa698e0561986ab544c

Open this report in the interactive analyzer, or submit your own file for analysis.