Malicious PDF — malware analysis report

Static analysis result for SHA-256 763a3f23329ccaf9…

MALICIOUS

PDF

41.2 KB Created: 2020-09-08 15:25:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: da90af7c9a397ec7b345c5012d2ea579 SHA-1: 6a6f170c88198d70ea1d8e0f9b95acfe6e3213c1 SHA-256: 763a3f23329ccaf9a90811c3a3aa2359b6225876d246ed2f78bcb8dc86358f9b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains embedded links, one of which, 'https://ttraff.cc/wix?keyword=camscanner+pro+free+apk', is flagged as a malicious redirector. The document body, though heavily obfuscated, contains text related to 'Camscanner pro free apk', suggesting a lure to download potentially malicious software. The presence of numerous other PDF links further indicates a link farm or redirection strategy.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/wix?keyword=camscanner+pro+free+apk In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://static.usrfiles.com/ugd/6cf392_4051cc29e72049dbae8602337ab21cc7.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b4609a_174fd6687c8941bfab19d9ec95f22d78.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/1c90dc_bbe5420cca3040629ad097a18081a704.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0465/5267/8558/files/which_order_to_watch_marvel.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/0636/9703/files/chuggington_theme_song.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/9801/3850/files/pseudo_dionysius_divine_names.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/857e61_001b7278c484422ba0f087d5514ec3c5.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/c4ccc4_1082e517ea104df39c09a461332fc7ef.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/b41a9a_9a9eff23dac344478c9ef2d72c825fad.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/4d400c_a1c10066fdc645dd9d04b3c69eca40ec.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/2eec94_1614339f9a04409dbedb707476f153a0.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/c4ccc4_adbeac35d74b4fe1803f92fd12cdecb7.pdfIn PDF document text
    • https://static.usrfiles.com/ugd/c63bf9_3dddbe4003844ad1907032a6b1fffb9c.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71F2 5096 bytes
SHA-256: 28dc2f9a9eb10f7889048eac884c2e3e3a7959261b367995d0d1fe5faac405c8
font_01_sfnt_off00008336.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8336 10588 bytes
SHA-256: 0427e985b7aabd52c1651c0b4b290232378e7f507a5b5fc9174f4fe136ec526b

Open this report in the interactive analyzer, or submit your own file for analysis.