Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fde1bfda18f39a3…

MALICIOUS

PDF

162.2 KB Created: 2020-09-02 09:48:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-07
MD5: 03dd83d5eda10a7662c3a14d17d3ca6f SHA-1: 363c7f1eb73c281ee52190af7f90c18dd367b9a9 SHA-256: 3fde1bfda18f39a375a616f383f316f813dbc19044422b9d24f65533105b6ef3
134 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier and contains a critical heuristic indicating a link to known malicious redirector infrastructure. The embedded URL, https://ttraff.cc/wix?keyword=left+right+arrow+icon, is the primary indicator of malicious intent, likely serving as a lure to a phishing or malware download page. No scripts were extracted, limiting further analysis of the payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9585

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=left+right+arrow+icon In PDF document text
    • http://www.gust.org.pl/projects/e-foundryIn PDF document text
    • http://dejavu-fonts.org/wiki/LicenseIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.nhncorp.comhttp://www.sandoll.co.krCopyrightIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://static.usrfiles.com/ugd/756799_33c3886c932a4d38b5ac0bc62bf0b9fd.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/7c3584_e2f3d40ff55b4fb49ae140cd322510c5.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/eddc50_3b7281fc563d459093db480074fc3486.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_0b29095131b647f2a26fc780a904d88b.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/0286dd_e5f2a132d67c443cbc77f91229a3713e.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/a4c1fa_43822aa92e5944c7aa1ffb1862f025aa.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/8b2c09_d2bf1df2f9094010a0e531a7e4d4e0d4.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/ba3095_7dd694157e0e412ca7cd6fcc8a3d3a38.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/de3d83_ce681626d7d44004a232563eec9a0205.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/a58b01_03a3ddfef2f341ba8f5457c0ce54f241.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_67c5535f64cc4a94b305c7f231320b18.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b8c837_12b032929c1c4d90a34db89513d70f04.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/857e61_89af4d5ae7964425a3a6407ba873d7e8.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/6308/3162/files/fagobaniniveb.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/4162/7029/files/tamimamobirogajajimiwimad.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/1018/5623/files/ayyappa_swamy_dj_remix_songs.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/5104/9370/files/61488392639.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_012_off00016cff.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16CFF 29388 bytes
SHA-256: 61dc00aaf06cd02fc4bf62881f0f006db705a17dee2e65e07d7952aab7260b5c
font_00_sfnt_off0000df24.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF24 10988 bytes
SHA-256: cc72746d57d874770b8fa38cb59e853edc7b00cb6a78cf32f68f947a0b980118
font_01_sfnt_off0000fcc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFCC7 2348 bytes
SHA-256: eff04d750179ad88b64e36109e62334535f604c27e3d0ef443d3a8d8a6093d77
font_02_sfnt_off00010652.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10652 3200 bytes
SHA-256: 394094a4fc38b3c1f29804d5be9969bc886fcd1818d597e8a63cf05011c63840
font_03_sfnt_off000111b5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x111B5 1644 bytes
SHA-256: 162c0a010de815b7113e95042773df5ff206858396d732a2cab15c40ed542f26
font_04_sfnt_off000119d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x119D9 4752 bytes
SHA-256: 4db5df71d1d8892698eeed7daef220d8100d0ef27d672397ea5be30e6d493eec
font_05_sfnt_off00012a04.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12A04 19616 bytes
SHA-256: 386c175be12f6b57619bba2f20afc57ae1d51e171a1f1d06ba7e920904dd2d84
font_06_sfnt_off00015324.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15324 6620 bytes
SHA-256: 6dd726c1add7b68bf2a72d0d454fe836d2ffd46bd6d0c7e2a19805b9cda8f1a0
font_07_sfnt_off00016345.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16345 2416 bytes
SHA-256: 6c7d182df3303fafb7b7de3072a18d8971ba8499de062a263266eb90ce62f625
font_09_sfnt_off0001b715.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1B715 14428 bytes
SHA-256: c080e846557e270a73678278cb4d91b34e339a0361b9b0c42efa49e0d1e28feb
font_10_sfnt_off0001e4e6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1E4E6 61400 bytes
SHA-256: 07f2eaf6820e47afedce6b18890d066e357af9ebae2a18a9f24abc78f2eda092
font_11_sfnt_off00026948.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26948 4324 bytes
SHA-256: 1158d95dac44631f497756703988ba3645251422e7ff0015d3fca430225e7c3e

Open this report in the interactive analyzer, or submit your own file for analysis.