Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ad7da8fbded1c52…

MALICIOUS

PDF

16.0 KB Created: 2020-10-18 14:25:49 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: b5182ee756d7679bc13cbce23defad84 SHA-1: 593967989c2455119aec722688f35707af6dc4bf SHA-256: 5ad7da8fbded1c52262132c5d2019f43c82222b01e7b78bb4f2b8048f7ea0089
202 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF is designed as a lure, presenting itself as installation instructions for Minecraft Forge. The document body contains a screenshot of what appears to be instructions, but the underlying structure reveals it is a link farm. The primary malicious URL, ttraff.link, is identified as a known malicious redirector, suggesting the ultimate goal is to lead the user to a malicious site for phishing or malware delivery. The PDF's small size and image-heavy nature further support its use as a deceptive lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9972

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 16 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/123?keyword=minecraft+forge+installation+instructions In PDF document text
    • https://cdn-cms.f-static.net/uploads/4365570/normal_5f88c0897ecdb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373768/normal_5f8a78870d151.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380213/normal_5f8aa6fbb1441.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366630/normal_5f888321e5d6f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366018/normal_5f8b81e1e60bb.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379482/normal_5f8baa2ff0818.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365998/normal_5f87b0a411916.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369508/normal_5f8ba347e34e1.pdfIn PDF document text
    • https://nafeziwubiwodi.weebly.com/uploads/1/3/1/3/131379183/jujivonot_sadiwegoj.pdfIn PDF document text
    • https://xoraxabaxid.weebly.com/uploads/1/3/2/6/132682630/forulatesanowe.pdfIn PDF document text
    • https://pevugubak.weebly.com/uploads/1/3/2/7/132740457/9d8450a7c8c5e.pdfIn PDF document text
    • https://kokubexajaluk.weebly.com/uploads/1/3/2/6/132681668/mutaloduwug-ganomidubit-zatuzigixob.pdfIn PDF document text
    • https://jawowigo.weebly.com/uploads/1/3/0/7/130774982/abef22d064547.pdfIn PDF document text
    • https://fanawilixu.weebly.com/uploads/1/3/1/4/131408209/9dca1250ec7.pdfIn PDF document text
    • https://dimaxafazeza.weebly.com/uploads/1/3/1/4/131453031/8767144.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ad72409d-1e73-4abf-ab9b-b2c8aa51f763/zevigipilu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/19f360a3-0de0-4b10-ae2b-d3cb00551990/kozodiwukupafifofina.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f1ea8beb-e8bf-4a14-9d1d-436e60f1c87a/57430364212.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f6835baf-bcb4-45be-9616-ecaccd41036c/mikonomolurekodeloguvu.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ea644b75-4692-4251-be25-ea4d566a2da1/17333461239.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0500/4309/3142/files/embed_file_in_excel_2020.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0502/3540/8576/files/aircraft_structures_for_engineering_students_download.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0483/7651/2669/files/new_glenn_development_cost.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/4993/4229/files/chicago_electric_90_amp_flux_wire_welder_parts.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0438/9647/1707/files/ivy_league_standings_baseball.pdfIn PDF document text