Malicious PDF — malware analysis report

Static analysis result for SHA-256 3017dd6dde328982…

MALICIOUS

PDF

66.0 KB Created: 2020-09-16 17:09:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-09
MD5: a53bac66e04fc2b0101a4145e129ff26 SHA-1: bbe45d7a6b47c408955694135860e98d9d75913d SHA-256: 3017dd6dde328982c8dd281752fe854150f610f429dc4ce6d3022b3e523a4414
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a critical heuristic firing for a malicious redirector link, directing users to 'https://ttraff.link/wix?keyword=philips+digitrak+xt+instructions'. Additionally, it exhibits characteristics of a PDF link farm, with numerous embedded links. The document body, though heavily obfuscated, contains references to the redirector URL, suggesting a social engineering attempt to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=philips+digitrak+xt+instructions In PDF document text
    • http://kasuxorev.soulblisshealingcentre.com/uploads/1/3/1/6/131606490/a669afcd28.pdfIn PDF document text
    • http://files.empirepanj.com/uploads/1/3/0/7/130775831/6678807.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://691b7cc2-c7e5-4af7-9ae8-95f664209ceb.filesusr.com/ugd/89064d_7c67132c7ee54f1491c8ea6a883c2e0c.pdf?index=trueIn PDF document text
    • https://3e2af481-0ae0-4842-a3fa-1b07beb6c7c8.filesusr.com/ugd/d6af85_95d4f4135b9040b6bd443daf869c1b0f.pdf?index=trueIn PDF document text
    • https://5c8eb7a4-4a4a-4355-8569-1b299627c53f.filesusr.com/ugd/2e4eb4_55d2fbaa93bd4e8d8d76c70ac337d421.pdf?index=trueIn PDF document text
    • https://bc2dfa02-4b1f-4b04-b0f7-399946790465.filesusr.com/ugd/3be48b_be92642e03ab4afda077dc36702e16b2.pdf?index=trueIn PDF document text
    • https://c0024e5b-650d-480e-b1b6-1121ad8f9499.filesusr.com/ugd/bba345_2c1026d9026e4d8f8d36d00f41bfc1d8.pdf?index=trueIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/7223/3380/files/xuronafewawig.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0450/1933/2766/files/ariens_st824_owners_manual.pdfIn PDF document text
    • https://5b296dfd-2b61-4cb7-9236-cc159661995e.filesusr.com/ugd/3eb4bd_5aa15c5763954b1c845b1957295c26cb.pdf?index=trueIn PDF document text
    • https://1c6f2fa6-44f8-4f77-bd50-50797ded761d.filesusr.com/ugd/b1b3ad_6a7f998415f544a6913786e7794486fe.pdf?index=trueIn PDF document text
    • https://39631599-c222-4c48-92c0-6cc8022ca34f.filesusr.com/ugd/9d869b_8e8b9d329bd44b67b4170f0d072a3887.pdf?index=trueIn PDF document text
    • https://b3986010-7d79-4ecf-a28e-ad4af654e52c.filesusr.com/ugd/3225da_720f88717d8b44ef927dbca03f39585e.pdf?index=trueIn PDF document text
    • https://e312fadf-6aba-421a-9ebd-8a1984e83471.filesusr.com/ugd/a4ea6c_755d0ba1a4b64c2fb7d7bd53bba8e105.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c11a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC11A 5468 bytes
SHA-256: f76992cfae69575c6d0483988682bfd8eda67587f5d3557c74419de42c6849b6
font_01_sfnt_off0000d3ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD3AC 11668 bytes
SHA-256: 2821923cd202cc3c601027e94c90ce5fb30c09c636bb7a00f74543fe5a2215f3

Open this report in the interactive analyzer, or submit your own file for analysis.