Malicious PDF — malware analysis report

Static analysis result for SHA-256 6982325b5d9b9658…

MALICIOUS

PDF

35.6 KB Created: 2020-09-16 16:53:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-07
MD5: 08409fd62d4149d551c4e3eddb283b16 SHA-1: d71ee37ea5647f74b0c2220ee342e8d5a0a1f910 SHA-256: 6982325b5d9b9658c49ddb298eacee07f1c5d99fdd8d95d618102292699cb7b6
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document functions as a link farm, presenting itself as a download for 'Principles of business forecasting keith ord pdf download'. It contains numerous embedded links, with one specifically identified as a known malicious redirector at `https://ttraff.me/wix?keyword=principles+of+business+forecasting+keith+ord+pdf+download`. The document's primary purpose appears to be directing users to potentially harmful websites through this deceptive link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.me/wix?keyword=principles+of+business+forecasting+keith+ord+pdf+download In PDF document text
    • http://menerima.altoonsultan.com/uploads/1/3/1/4/131406999/zakinixinemapo.pdfIn PDF document text
    • http://files.lakemichigandance.com/uploads/1/3/1/3/131380236/9302408.pdfIn PDF document text
    • http://files.wesleyclass.com/uploads/1/3/1/3/131380627/35a601fa8bc4d0f.pdfIn PDF document text
    • http://tudore.bwvalencia.com/uploads/1/3/0/9/130969868/28dcb71c319714.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://71c943b5-f205-42ab-b77b-05c277a7f3c4.filesusr.com/ugd/3225da_e59109502c8e4fe78743368439b87009.pdf?index=trueIn PDF document text
    • https://03c9e0ef-94a1-43a9-a16b-60f1de1acfcc.filesusr.com/ugd/9ea91e_72ab9a2b0ffe4a6e8bf84175307d3f6b.pdf?index=trueIn PDF document text
    • https://565573ad-b65e-4ff1-8bd9-3dd32aeb0cd4.filesusr.com/ugd/5f226b_d932f3d51bb0458d9231168523d75844.pdf?index=trueIn PDF document text
    • https://e2b3d81e-c0e8-4025-969e-de144ab90861.filesusr.com/ugd/8da65f_2303dddeec6445249a529618bd639ad2.pdf?index=trueIn PDF document text
    • https://437236ff-6a11-49f6-b8af-8b51d3953105.filesusr.com/ugd/031dda_29123ac1f4e94bd78b34e090b4adbbde.pdf?index=trueIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/0630/4166/files/31519590562.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/6105/9477/files/xufexedorakegumewuvop.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/9911/2095/files/advanced_life_support_manual_7th_edition.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/5916/7900/files/27957812692.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/9436/7644/files/81206520404.pdfIn PDF document text
    • https://963c18ca-421c-4fed-80f2-1e449c2b6999.filesusr.com/ugd/011e4b_cec88028449449e3ba736e168a33abc5.pdf?index=trueIn PDF document text
    • https://445e3b32-74e3-4f57-82a4-ac988050d83f.filesusr.com/ugd/fb5067_8eaaff10246a4bb5bff4029d2e4ebfae.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b09.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B09 5712 bytes
SHA-256: 37cd9796bcccd764fe1ae869b2f11212ccaccae3d084c357c2330e410c24d267
font_01_sfnt_off00005e80.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E80 10184 bytes
SHA-256: 20ab965ff1e896d11849182ea34141a276316baecb454e52b671d6fe6767d9dd