Malicious PDF — malware analysis report

Static analysis result for SHA-256 290e054e6e99942d…

MALICIOUS

PDF

121.9 KB Created: 2020-09-10 10:42:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-07
MD5: 00e6ba30cc049180fa921e14e3c6322e SHA-1: a275e4eec0fd7264ea1f9fbd67a3b5c44ab0fc8b SHA-256: 290e054e6e99942d59b14baa2ca87a62cbb0c4aa2e1770cf2361bafe9931e4dc
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a malicious redirector link that points to ttraff.com, which is known for hosting malicious content. The document body, though heavily obfuscated, contains the same URL. The PDF also features a large number of external links, many of which point to PDF files, suggesting a link farm or SEO poisoning tactic. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/wb?keyword=tutorialspoint%20ms%20word%202007%20pdf In PDF document text
    • http://files.jacquelinedeangelis.com/uploads/1/3/2/6/132681394/gonaz-bofewubam-tomavo.pdfIn PDF document text
    • http://files.divinesoulenergy.com/uploads/1/3/0/9/130969819/d55ccdadbe3c.pdfIn PDF document text
    • http://ravuronaj.tummystuffer101.com/uploads/1/3/0/7/130739431/timuwubow.pdfIn PDF document text
    • http://zipidulu.highstitch.com/uploads/1/3/0/9/130969959/tutiketusokikukemoz.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/8702/0703/files/13242087964.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0446/2352/8099/files/fibixemepigenososozudij.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/9392/3742/files/balu_mahi_film_songs.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/a86d68_1e2a51e6275b483fa4e9c6f9416e390a.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/19103d_512b9a5c97a146e782a51c3a6bd78bfd.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/027f51_9bf1d6b3c9c042e98005c56529efc628.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/bfd504_28c2a3edc83c4154915ba89103da76ef.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/7ea8bb_9cfc241dbd0449e09ad0ff9e178858bd.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/cd1d52_b10d6155588741efb273527e8ad64590.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/c7ef1a_3fcdc12db79441c58d8c851379cd78f7.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a32b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A32B 5584 bytes
SHA-256: 617892405f782372139300898c6b6eced6e56b2a76894b800b841200fbd97eb0
font_01_sfnt_off0001b625.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B625 10508 bytes
SHA-256: c5ccf43666b8fcbd0fa897260eb8ed2ab4792b58a6f0b13d3b16813a6a033214

Open this report in the interactive analyzer, or submit your own file for analysis.