Malicious PDF — malware analysis report

Static analysis result for SHA-256 59b0ed6d2c3c7e9e…

MALICIOUS

PDF

53.5 KB Created: 2021-01-14 08:42:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 89969b33ddcc7bf84bca8a2385f00c07 SHA-1: 600b279ff5fe9eacabba60b98e6d04800f8ff80f SHA-256: 59b0ed6d2c3c7e9e3ae342a6bcf71ccb317a98b6d912ebe7a17511de79ec3876
182 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded links, with one specifically identified as a malicious redirector. The ML classifier and ClamAV detection strongly indicate malicious intent. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool sometimes used to create malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7092

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffking.ru/123?utm_term=freedom+hack+apk In PDF document text
    • https://static.s123-cdn-static.com/uploads/4380701/normal_5fcd5691432cd.pdfIn PDF document text
    • https://zolegezuboz.weebly.com/uploads/1/3/4/4/134462972/9945345.pdfIn PDF document text
    • https://site-1172464.mozfiles.com/files/1172464/gujojevojo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4490754/normal_5fd718795ea71.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480187/normal_5ffb10d616287.pdfIn PDF document text
    • https://cdn.sqhk.co/betewulo/YZ1hfgg/frisbee_forever_2_all_trophies.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369653/normal_5fe92e42ab64b.pdfIn PDF document text
    • https://site-1180408.mozfiles.com/files/1180408/nifeparalarej.pdfIn PDF document text
    • https://site-1178471.mozfiles.com/files/1178471/jidudojumi.pdfIn PDF document text
    • https://togitarusufojir.weebly.com/uploads/1/3/2/6/132681229/gekotareluwele-fipet-sosiwuneposi.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4410000/normal_5f9ea5fc42be3.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4466175/normal_5fde1acdda0e4.pdfIn PDF document text
    • https://bilewazivabo.weebly.com/uploads/1/3/2/8/132816117/c4fc203fa.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4452152/normal_5fb9408a4d650.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.