Malicious PDF — malware analysis report

Static analysis result for SHA-256 793c9885ad89f397…

MALICIOUS

PDF

48.7 KB Created: 2020-10-10 21:51:28 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-15
MD5: 178eed6611b995a01b663ae3ec8d6228 SHA-1: 081dfc31664b961d8596c8fcd21decf8d5cfd75e SHA-256: 793c9885ad89f3974c7d403900fffe0091e44ab44fe3a617d888369b9118404d
132 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=craigslist+honda+accord+parts In PDF document text
    • https://site-1038539.mozfiles.com/files/1038539/bafevidizetowa.pdfIn PDF document text
    • https://site-1042106.mozfiles.com/files/1042106/gowidaz.pdfIn PDF document text
    • https://site-1037212.mozfiles.com/files/1037212/6894060176.pdfIn PDF document text
    • https://site-1048488.mozfiles.com/files/1048488/gujepugeduwa.pdfIn PDF document text
    • https://site-1036830.mozfiles.com/files/1036830/pejokori.pdfIn PDF document text
    • https://site-1038684.mozfiles.com/files/1038684/tivinijunal.pdfIn PDF document text
    • https://site-1037018.mozfiles.com/files/1037018/navirunefazu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/749ddb1b-dfa7-40ba-b5a4-c09f569f5745/nijejofaniwexuzob.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e351566-d116-4da2-91ff-7d18d1948912/pirovirive.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/32d661f5-473b-4dc4-b332-d787ddd20e30/39156977329.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/71ad255c-61c5-4a67-b432-d421ce4195e5/97010932455.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63d3f9d2-e5e8-434b-94a2-5c64dab3457a/24406018.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ac195580-e408-4718-acaf-00d9ccd882b1/50781035712.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e1ce443d-f12c-4d26-99a4-1805dd172039/guxidajemasemufi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7a4a5bf5-eb9d-4554-9c45-eff8f8b33a10/87707844913.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ebe5457-3cb5-49f1-90d8-368eb6d6de4d/77302028420.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000080f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80F7 5240 bytes
SHA-256: 36b48fec72c26d8f42fe4d3c0de7e19ded07da40ec217cd8624bbe84d2fb7431
font_01_sfnt_off000092b1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92B1 10488 bytes
SHA-256: 4124d32def1e179acf169dbb0d56a014e3bc358ba14bf4f98f4817ce3259ab93

Open this report in the interactive analyzer, or submit your own file for analysis.