Malicious PDF — malware analysis report

Static analysis result for SHA-256 52b4edaedc30888f…

MALICIOUS

PDF

105.8 KB Created: 2020-07-29 06:24:16 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-09
MD5: bb82a782df9083e0d85791b322b5aa80 SHA-1: 7ac91f79cc378a660576424caf577d05a62698ce SHA-256: 52b4edaedc30888fbd2f2268d97b7e3d889a805e094d4d1db61e619ee4e7ad96
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by multiple critical heuristics for containing malicious redirector links and a large link farm. The primary malicious URL identified is ttraff.com, which is known for redirecting to malicious infrastructure. The document body contains garbled text, suggesting it is not intended for human consumption but rather to host these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/pify?keyword=responsible+answerable+synonyms In PDF document text
    • http://files.the12thcan.org/uploads/1/3/2/8/132814155/7596359.pdfIn PDF document text
    • http://files.pattidunne.com/uploads/1/3/1/1/131164431/3823370.pdfIn PDF document text
    • http://files.anncartermedium.com/uploads/1/3/0/8/130873983/jomopikoru.pdfIn PDF document text
    • http://files.fatbellybassmasters.com/uploads/1/3/2/7/132740552/591523.pdfIn PDF document text
    • http://files.estellessweetitchblankets.com/uploads/1/3/1/4/131409170/tixavaxanepuluxuvit.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/0687/7080/files/gowaluzefep.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/1137/5267/files/rebus.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/0052/9049/files/50184370285.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/9416/3109/files/sokekedatopolupamatavituj.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/2897/1674/files/navapazikigafijudeneb.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9688/3868/files/xiwosidajaku.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/3892/4181/files/26406551005.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/7541/9798/files/kikizatofofebinaw.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/7066/0508/files/sotilonowok.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/4447/0945/files/32690992274.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/9004/3285/files/kemoduxizuletalezug.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/5945/3860/files/zivufigusugixojixa.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0441/1126/5944/files/86166583168.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009b0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9B0D 22264 bytes
SHA-256: e83db5769b4975273a5336b507375897fbcd750877e320cb0c193ad4e7f9e2f3
font_01_sfnt_off0000e20a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE20A 5016 bytes
SHA-256: 4d9f6eec6097e221e91b114edb6de613cab499abd7f3ada9a4d26b4b13ed0f19
font_02_sfnt_off0000f2f4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF2F4 12104 bytes
SHA-256: 9768db340ff6f54b70159041f9eec3eeb37a80ba3e38ceba67725a7eee9b975f
font_03_sfnt_off000114dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114DC 21524 bytes
SHA-256: 40e3fefbe060f0f1e2df2498c4770981ee9b89f5a277d1c0f8b4fdeb523854cf
font_04_sfnt_off000153d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x153D0 26472 bytes
SHA-256: 0f8bcd08a48f0ce877ba08cb1bb8ddf79b1274f0f014f63f3e41903dbc2e6f93
font_05_sfnt_off00018212.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18212 6524 bytes
SHA-256: bd6c0974da9c92f2a2b3436f86d98d6f8f7744149df803ebb4fc69b55831fb88

Open this report in the interactive analyzer, or submit your own file for analysis.