PDF malware analysis — malicious · 746e60dd5fbd33cb

MALICIOUS

PDF

49.6 KB Created: 2020-11-13 20:54:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 076080354df409257de3b78d35fd39ce SHA-1: fd636824625afefac73160038f558a8015a64ede SHA-256: 746e60dd5fbd33cbbedcba2681cd877a04bc7cc9f7fc48a9cbcd65740e2991cb

192 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a malicious redirector link, identified by multiple heuristics and ClamAV, which is designed to lead users to a phishing site. The embedded URL `https://ggtraff.ru/aws?utm_term=citation+apa+format` is flagged as malicious and likely part of a phishing campaign. No scripts were extracted, but the presence of malicious links strongly suggests a phishing attack.

Machine Learning

Nyx PDF Classifier malicious score 0.7011

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ggtraff.ru/aws?utm_term=citation+apa+format In PDF document text
- https://cdn-cms.f-static.net/uploads/4372087/normal_5f88d512d333b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4415045/normal_5fab84dd1049b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366308/normal_5f8e9803e982c.pdfIn PDF document text
- https://s3.amazonaws.com/tadovu/introduction_to_bioorganic_chemistry_and_chemical_biology.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38dc73bb-3394-4eb3-b729-ec31a6b74e4d/sukejifikepokewez.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/47cc76e8-b9f8-489f-9b2f-0099a62afaf5/1276380754.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4e6eb419-63e7-4f03-bb8b-8c1e7a82fdec/xofomilarivipure.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4fdbdc94-fab7-4e90-b05b-46e4aee6ff38/zukijavodilapumofuri.pdfIn PDF document text
- https://s3.amazonaws.com/fajonubinomeder/honeywell_hrgx45_manual.pdfIn PDF document text
- https://s3.amazonaws.com/kabisebax/gixogufol.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/715a1735-f624-4fa7-af9c-6f0761d25a55/duvibidiparomigo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/0301419f-bc95-4bf3-af53-790105093add/puzasipedunokuvewof.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/8cff2635-b39d-4680-ae6f-8e00fbdef868/55280800042.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/e198eaa1-4497-4582-84cd-db390ff87fc0/kudizemuvipepiwixikowe.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.