Malicious PDF — malware analysis report

Static analysis result for SHA-256 3779fb0c15dcb081…

MALICIOUS

PDF

80.8 KB Created: 2020-12-20 08:33:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 89344d3ad9a5416252f11f94dfdc221a SHA-1: 5871e9d73b5496f2138d4422c7efe69f99b889f5 SHA-256: 3779fb0c15dcb0812e15ac632417d15c7b9ebca01f7ae68c089ffc2681f8986e
254 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file is identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. The document body, though heavily obfuscated, suggests a lure related to a "Westinghouse timer manual". The presence of a large number of external links, including one to "traffking.ru", strongly suggests a link farm or redirection mechanism, likely intended to lead users to malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=westinghouse+timer+manual+28011 In PDF document text
    • https://negotibuveno.weebly.com/uploads/1/3/4/7/134733978/jarurobejesonuki.pdfIn PDF document text
    • https://zixatemanareku.weebly.com/uploads/1/3/4/4/134472678/6284620.pdfIn PDF document text
    • https://mosuzikovadapa.weebly.com/uploads/1/3/4/6/134667275/1283285.pdfIn PDF document text
    • https://tamalokumolegi.weebly.com/uploads/1/3/4/6/134656593/9e856.pdfIn PDF document text
    • https://firedisivimi.weebly.com/uploads/1/3/0/9/130969818/fa03d8615.pdfIn PDF document text
    • https://nokaxogu.weebly.com/uploads/1/3/4/5/134520383/1ffe23f24282.pdfIn PDF document text
    • https://bokixewabukogu.weebly.com/uploads/1/3/4/3/134341992/fosazibusidut_gikefurovek_wovesetegudeti.pdfIn PDF document text
    • https://medizagokitoni.weebly.com/uploads/1/3/2/3/132303310/gizixulu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://scripts.sil.orgThisIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static1.squarespace.com/static/5fc112aed26ff1194f74a888/t/5fc1c7ba9d79364840cfb1d5/1606535099720/fasovuj.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbfd016c30a162e0c4c3cab/t/5fc34ffe7acac6192a2a91f3/1606635518914/89903607590.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc11101d26ff1194f749d44/t/5fc5e62c3c6ccf69f32b2eae/1606805039633/sofefu.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc7185a5fa98a681f0c9b59/t/5fcdadec2fa8bc6bcd06e6c1/1607314924539/kajuwowo.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc002d40b6b03258f30bf3d/t/5fc21243e18c5c478e433cd3/1606554180334/dmv_jackson_ms_id.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc578abd49dd1244753261b/t/5fc9cdda9309303fb831e0c3/1607060955221/34995913850.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.org/In PDF document text
    • http://scripts.sil.org/OFLAbyssinicaIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000be8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE8E 5516 bytes
SHA-256: bc3a3327c6b0eeba430b64de11308b59aa3d782ba8dec0d015bfdef8a7d7a702
font_01_sfnt_off0000d120.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD120 20800 bytes
SHA-256: 8f3c6ac098290535930a62471c59cc01db724254982e8b22b5293056f919eaaa
font_02_sfnt_off0000f0c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF0C5 4856 bytes
SHA-256: 27af942ab1e570af72be485ed70e2db2e63c2e3ff550e9df1811ae7dabc494a0
font_03_sfnt_off00010324.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10324 10568 bytes
SHA-256: 60831dc78d277daedccd4597520e96e409fa4038427a016645d09080912699e1
font_04_sfnt_off0001273f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1273F 4324 bytes
SHA-256: 4fcfa7c68d76e23b667942a3ac892d2d5d88346478daafc61479ad4df4af3dd3

Open this report in the interactive analyzer, or submit your own file for analysis.