Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d6f033209c4121b…

MALICIOUS

PDF

33.6 KB Created: 2020-10-23 21:45:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 1f92b1f73cd1a7c4413e61280b719836 SHA-1: 51a2e2a9b56b40b2fee8880f74889e7154c1e0ec SHA-256: 3d6f033209c4121ba13f0dbe79876ddcfbc4a933633d573701bcac8645a34186
192 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains multiple heuristics indicating malicious redirector links and a link farm, suggesting an attempt to drive traffic to potentially harmful content. The embedded URL and document body text explicitly mention 'bhaktamar stotra sanskrit pdf download', which is used as a lure to disguise the malicious intent. The primary redirector URL is https://gettraff.ru/aws?keyword=bhaktamar+stotra+sanskrit+pdf+download, which is a key indicator of this attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/aws?keyword=bhaktamar+stotra+sanskrit+pdf+download In PDF document text
    • https://cdn-cms.f-static.net/uploads/4368979/normal_5f8c7a348cbaa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368748/normal_5f89cf5b4d471.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404723/normal_5f9184faea725.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369189/normal_5f8976d3028b4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373779/normal_5f8a8e6428c21.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369762/normal_5f8824d0b1466.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0477/6201/4364/files/say_it_with_symbols_investigation_1_ace_answers.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0266/8540/7421/files/44662919327.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0501/1688/6678/files/dizolegalabegenuruzonu.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/3595/9202/files/wool_book.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/1443/7033/files/house_plans_free.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/6035/3429/files/denyo_welding_generator_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0493/7534/6847/files/emotional_appeal_in_advertising.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/7863/1072/files/fovufudozofebonitosid.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0484/7612/7394/files/zapijisazazitedusilelax.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.