Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c418825c31b2fa0…

MALICIOUS

PDF

14.9 KB Created: 2020-10-23 05:09:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 9a16d4b438c7ac9491dc4508f83b93ed SHA-1: 8916508ab8b7adbaefed75a822601e058dc799d3 SHA-256: 3c418825c31b2fa07ff0c1f6cf1fac5f2f377489eda5b6cd167ae2e4231b6f59
132 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a link disguised as a document title, which redirects to a known malicious URL. This suggests a phishing attempt to trick users into visiting a malicious site, likely for credential harvesting or malware distribution. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9807

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/123?keyword=social+media+marketing+strategy+pdf+2020 In PDF document text
    • https://zirufifun.weebly.com/uploads/1/3/0/8/130874679/8076346.pdfIn PDF document text
    • https://rivisoni.weebly.com/uploads/1/3/0/7/130739016/nijijosawuwuz-nenopule-rozafi.pdfIn PDF document text
    • https://megadezatesaram.weebly.com/uploads/1/3/0/7/130776649/lezepasidixabazafe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e2d8445e-2952-44a0-a11d-b63a58319111/62933509213.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1a7cf597-8a68-490b-8faa-6b3d30b99208/femabepozamibug.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/42185c29-2a8f-489f-b7cc-ec9116f62281/85021681335.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e9d7468-1357-490f-ae33-8061d5b86267/xorefogeri.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e5c6ff4-c33c-4b53-b8a8-652f9de31ac0/kumasunorokasikemizuvo.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.