Malicious PDF — malware analysis report

Static analysis result for SHA-256 af23af4aff2f5563…

MALICIOUS

PDF

83.5 KB Created: 2020-12-11 21:14:39 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-21
MD5: 2c8f9fa7457942aa2d2af93e718eea34 SHA-1: 06d0ed9023994a212402be50a3cc7090b333f340 SHA-256: af23af4aff2f55639fe1afee894339f2c6682fd51e5c6ab7de1d8509fd44b3a3
194 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/wb?keyword=ielts%20band%209%20writing%20sample%20pdf In PDF document text
    • https://xuremesedadewo.weebly.com/uploads/1/3/4/5/134500919/9537738.pdfIn PDF document text
    • https://nekekijubexofus.weebly.com/uploads/1/3/4/5/134587401/ebcff6c65e02a.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static1.squarespace.com/static/5fc5bc7ddf132613bbdeaa48/t/5fc8aacf13de6e79815ffd9e/1606986447538/21534645629.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbce344be7cfc36344e8aaf/t/5fbcf037cc750a3b5a04ea47/1606217784328/dartmouth_timetable_of_class_meetings.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2d644bce-a4b5-476d-960b-f28549698895/pitaxenuguwog.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea5559fa-9a83-4091-9440-6ee7efe4d267/48867451109.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc5947bc6d964583641de38/t/5fd025f1ab2d482295d4503e/1607476724026/62157616642.pdfIn PDF document text
    • https://s3.amazonaws.com/lulelepese/bronchite_acuta_asmatiforme.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0dc532e34347c7043ce2c/t/5fc13d63f3de5e49b591d716/1606499691985/kawalenigopudagejan.pdfIn PDF document text
    • https://s3.amazonaws.com/pafiganovavi/clash_of_clans_hack_cydia_2018.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0de9c5bcb0228a2825217/t/5fc0fd439b1ed03538fec95e/1606483269082/37671691650.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0696cdf132613bbbb46ad/t/5fc0d96d61e25426e1580ee1/1606474095367/ryobi_blower_vacuum_bag.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc1162b68612547ed5f39f0/t/5fc8a36d217b3604ede1479f/1606984557504/ranking_arcade_fire.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010666.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10666 5688 bytes
SHA-256: e72e21778b8aefe904e210936d8ac7491af8bb17c454f56b9812bdb130f82180
font_01_sfnt_off000119b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119B4 11784 bytes
SHA-256: c521f423cf3f92964ca600ae0cd57cada6991555a8480c787bc76bb26c74ead9

Open this report in the interactive analyzer, or submit your own file for analysis.