PDF malware analysis — malicious · 67bfe53855fd6af1

MALICIOUS

PDF

18.6 KB Created: 2020-10-25 20:01:33 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: af8681b9bd0ea3781a322056cd0384b7 SHA-1: 95a4a2fbbe09950c7b056f13a698fd9f40bc751a SHA-256: 67bfe53855fd6af10cda70fc4eacac3a2e055820545900f3e5aadcc7ad116231

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, identified by multiple heuristics as a critical threat. The document body, though heavily obfuscated, contains the same URL, suggesting an attempt to trick users into visiting a malicious site. No scripts were extracted, but the presence of a malicious redirector strongly indicates a phishing or malware delivery attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9986

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?keyword=sistema+renina+angiotensina+aldosterona+pdf+2017 In PDF document text
- https://cdn-cms.f-static.net/uploads/4365586/normal_5f8766af645bc.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4372382/normal_5f9124ccd406c.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/b5ab3d61-524c-4c21-8d09-588cfd607f52/guvazewopavirulekulap.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/591eaca7-d69d-457e-b489-f7098d4ac0dd/tarjetas_del_dia_martes.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/22c13de6-70fa-432e-bd8f-eb86bd4eeadc/5607240283.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/41797e6f-ded8-43b4-ac76-be2e24eb5255/93914925013.pdfIn PDF document text
- https://s3.amazonaws.com/gupuso/actual_reading_test_2018.pdfIn PDF document text
- https://s3.amazonaws.com/fadedosi/36830074815.pdfIn PDF document text
- https://s3.amazonaws.com/zuxadol/99047063799.pdfIn PDF document text
- https://s3.amazonaws.com/putelekireza/26145072572.pdfIn PDF document text
- https://s3.amazonaws.com/subud/fadiv.pdfIn PDF document text
- https://s3.amazonaws.com/fapaga/nuvezusususomepazuxeb.pdfIn PDF document text
- https://s3.amazonaws.com/jumedemimo/dinawakot.pdfIn PDF document text
- https://s3.amazonaws.com/xanebavifamopez/53507376847.pdfIn PDF document text
- https://s3.amazonaws.com/xanebavifamopez/xedatap.pdfIn PDF document text
- https://s3.amazonaws.com/tetazino/sanamifepudujeju.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.