Malicious PDF — malware analysis report

Static analysis result for SHA-256 941cabccdf6d8f00…

MALICIOUS

PDF

87.7 KB Created: 2020-10-23 02:53:19 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-12
MD5: dab8b3946c3a6ba994d24afdd9147d4e SHA-1: f0f35fa0ceda44c904b288ea2325c4533521482d SHA-256: 941cabccdf6d8f00c5295a5d94397dd3c6822ba7ac2a92a0e04e0f5e61790db2
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/wb?keyword=manual%20teclado%20yamaha%20psr%20e233%20em%20portugues In PDF document text
    • https://cdn-cms.f-static.net/uploads/4368243/normal_5f910dfa70741.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365642/normal_5f88ca1fdd4f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4377114/normal_5f908cc59364f.pdfIn PDF document text
    • https://bidutujube.weebly.com/uploads/1/3/4/4/134403342/4848834.pdfIn PDF document text
    • https://wefamojugibe.weebly.com/uploads/1/3/1/1/131164519/6796784.pdfIn PDF document text
    • https://jiwepurojal.weebly.com/uploads/1/3/0/7/130775762/lusexaxapel.pdfIn PDF document text
    • https://xebikazogede.weebly.com/uploads/1/3/2/7/132740990/28fef585a7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374175/normal_5f8d570749dff.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379970/normal_5f920552e6516.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4407070/normal_5f91f7ace1cbc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4391602/normal_5f920d785599e.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373999/normal_5f892a148541d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fecb13de-513c-4868-a869-f24f7827d66b/nivakiz.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/855b011d-4349-4e51-845d-e2513e69e655/62997647327.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0010450b-942e-4606-9395-4b2eab709e50/51012760523.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c3340085-d596-41fe-85ce-18900e3841e8/10751165266.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ede6b23f-c06e-4e44-95c8-0dda4e5e5c88/50148673392.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4df8bbb-cf7d-447f-bc95-12be923ecad5/tarur.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b16d10d5-6025-4932-bea3-3934baac481c/gifalubixozib.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63d4ac24-eda2-47bf-bd9c-a75bd7676aa6/bufenubosikin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/911de1ac-c3f9-476f-b0c0-874917e335e2/98997709045.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b4ef1b32-996a-4b30-a580-226a85430061/vaxuwilexuj.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f84.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F84 5888 bytes
SHA-256: 3e7e4c7efab048fe57544a65a0837059f6dff11a5fe756ce7cb70d7901164d84
font_01_sfnt_off00012367.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12367 15180 bytes
SHA-256: e6c0c11fba63334d222ba03f4210a15f66f386058f2e37ccdeb78ad1cc693ff4

Open this report in the interactive analyzer, or submit your own file for analysis.