Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d9bee8879bef4c7…

MALICIOUS

PDF

115.4 KB Created: 2020-08-11 23:48:07 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-08
MD5: 43fe4aab755046af7b3129de40b33b6e SHA-1: 7140353cde90deb0239341cd8b5d18e4e9a1df87 SHA-256: 6d9bee8879bef4c75f6a271de2c0ac5eeee7350115de1cd514dff8fe9a17dd05
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, many pointing to a redirector service (ttraff.cc) and a link farm designed to mimic legitimate content. This suggests an attempt to drive traffic to malicious sites, likely for phishing or to serve further malware. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9949

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=infinity+mathematics+pdf In PDF document text
    • http://loleziv.theroanokerestaurant.com/uploads/1/3/1/0/131071041/bulire.pdfIn PDF document text
    • http://files.photoglens.com/uploads/1/3/1/4/131482976/2884371.pdfIn PDF document text
    • http://files.enkisuma.org/uploads/1/3/0/8/130874257/paruganufijadove.pdfIn PDF document text
    • http://files.apdcwa.org/uploads/1/3/0/9/130969435/kenixumajoz-kuladuba-wutorixevetik.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://smc.org.in)MeeraRegularMeera2016SMC7.0.0+20171102HussainIn PDF document text
    • http://smc.org.inhttp://smc.org.inIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/1769/9477/files/javofuwudeganukeg.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/4302/9143/files/mva_form_dl-_202.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/6486/6469/files/70137561997.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/0840/0280/files/java_code_snippet.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/4603/4846/files/yard_machine_snow_blower_manual.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/1810/0637/files/zumikemoxadawebodopib.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/1358/7623/files/mm_to_cm_conversion_table.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/6320/6307/files/fosedo.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/6596/6741/files/wefagijesugajufuwof.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/8218/5893/files/tevigiteminajubozubov.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/8379/2545/files/promenades_2nd_edition.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0433/4151/2855/files/caveman_diet_meal_plan.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • https://gitlab.com/smc/meera/blob/master/COPYINGIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000114df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x114DF 3976 bytes
SHA-256: 19e425d68dfe36301db90bae8e833881f0aa73ae4cbe63a99581e0e38f31924d
font_01_sfnt_off000122e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x122E0 5304 bytes
SHA-256: f40a83dc76fb2c8d66479e0acb1ddbf641b7f5f64c41f57137bd0bf7c9f3a9d5
font_02_sfnt_off000134bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x134BB 3292 bytes
SHA-256: 01e1007261053f41cc6fc87fe25df83e52c9e84432781f745964dedc794331d0
font_03_sfnt_off00014199.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14199 4412 bytes
SHA-256: 343003a0189d15cdd25cc5b1c7b18a617045e11e4a495cff4d4221b4c6c6b9ed
font_04_sfnt_off00014f2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14F2C 6316 bytes
SHA-256: c6dcd548442b101a016af7a542e3dc08878ff8ef4ba844f8ddd32910dd4ce4cc
font_05_sfnt_off00015fba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15FBA 17944 bytes
SHA-256: e09351e60dffeab934326eafefe9936f6c3777cfa42178d5e86fd208b91bccaf
font_06_sfnt_off00019731.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19731 16436 bytes
SHA-256: 513ed46d99093e10832f9177f6873790093bc6345ff68643eccc0443e8bbaba2
font_07_sfnt_off0001ad7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AD7D 6460 bytes
SHA-256: e7df87bd9b01f15d92e9da8a7ac79b780170950d01616ab6e9c60a90077d57aa

Open this report in the interactive analyzer, or submit your own file for analysis.