Malicious PDF — malware analysis report

Static analysis result for SHA-256 941f51dc59c0e48e…

MALICIOUS

PDF

31.4 KB Created: 2020-11-05 12:52:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-12
MD5: cba4eeb6b724ded7cdee63a842602e9c SHA-1: 5313ff1aee717f20969ed9daba772b049e4da221 SHA-256: 941f51dc59c0e48e9ee4a290913c2d5d479363581ca694e2d1694f7cfcb13bf8
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/wb?keyword=download%20pokemon%20tcg%20online%20apk In PDF document text
    • https://cdn-cms.f-static.net/uploads/4366381/normal_5f87430b4e600.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4403259/normal_5f983c8355b36.pdfIn PDF document text
    • https://zatazonikafude.weebly.com/uploads/1/3/4/3/134340422/5e68635e8.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/nagev/antimicoticos_naturales.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5c1f740e-1be1-49b9-af4b-731e396e823a/mk11_scorpion_spear_in_krypt.pdfIn PDF document text
    • https://s3.amazonaws.com/salosibejodod/84804100439.pdfIn PDF document text
    • https://s3.amazonaws.com/susopuzupure/bribery_and_corruption.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8dd10c9e-56f3-42c0-be3f-5b275e465987/78791334512.pdfIn PDF document text
    • https://s3.amazonaws.com/tesapibebujep/methods_of_adulteration_of_crude_drugs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/be511a26-9e78-4a37-858d-431da95563c3/fetujixovewilegexuwaxamex.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/060b7800-8fc4-4ebf-9113-3eb8c76f2cb4/fudizugemu.pdfIn PDF document text
    • https://s3.amazonaws.com/gafedupeba/xitudagaxizep.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/adef76e2-f5a7-4a1f-ade0-e515ea4bfa55/rachel_carson_primavera_silenciosa_resumen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d549c45f-54f7-4767-8aa9-08f8bed7aaf8/5351686606.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41AC 5272 bytes
SHA-256: 235483bc198bc726329c475938befda9e8ec562ce88827d0eca80a0f88ad1149
font_01_sfnt_off000053ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x53AD 8712 bytes
SHA-256: 79c6de535959545dbcd935683b3756310e035f86f6f8974cc7564b765695e3a3

Open this report in the interactive analyzer, or submit your own file for analysis.