Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ee12b412e25270b…

MALICIOUS

PDF

44.2 KB Created: 2020-08-20 18:32:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-09
MD5: f48f2750b5df7ca3b140cd0a6afc76b6 SHA-1: a989c83a4c6125fb34c8f7994be192ad766c3c82 SHA-256: 7ee12b412e25270bba915fc63a7ed20dc5357603a7f70c2549655862897e93c4
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple embedded links, including one pointing to a known malicious redirector at 'https://ttraff.ru/pify?keyword=brothers+song++sapna+jahan'. The presence of a large number of external PDF links, many hosted on Shopify, suggests a link farm or SEO manipulation tactic to obscure the malicious redirector. The ML classifier strongly indicated maliciousness, supporting the conclusion that this document is designed to lead users to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
    PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=brothers+song++sapna+jahan In PDF document text
    • http://kiguxaden.olvsf.org/uploads/1/3/0/7/130776167/5035683.pdfIn PDF document text
    • http://files.camarillochamber.org/uploads/1/3/0/7/130776578/a8940658a39.pdfIn PDF document text
    • http://files.misspatsyspreschool.com/uploads/1/3/1/6/131606222/c28faa2.pdfIn PDF document text
    • http://files.cementx.org/uploads/1/3/0/7/130740231/1345155.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/9078/8000/files/30587428731.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0458/5432/6937/files/formel_1_boxenstopp_zeiten.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0428/4055/5687/files/23210508335.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0432/9714/4990/files/jokuraxelenasuzuvizeba.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/7003/6904/files/class_12_rbse_biology_book.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/7153/7301/files/77598918502.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/8094/9659/files/fugusogopavifi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0431/6259/9583/files/1908762309.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0439/2802/7304/files/bacteriologia_y_micologia_veterinaria.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0430/5122/1146/files/93812918256.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006255.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6255 5172 bytes
SHA-256: 75531b8bfd7693c0ae754f878b5201e08a799bc21bc754def12341d2c7ae836b
font_01_sfnt_off000073f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x73F1 9816 bytes
SHA-256: 03199fa16cb72e591c0b5fac3e4261e0ee36a69bbc6736305cdb3287e8629b96
font_02_sfnt_off000095b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x95B6 3680 bytes
SHA-256: 783075ef8e6df6cf0eefaa9c488a5e15e452beb1dd88a24ddb8559dc50583677

Open this report in the interactive analyzer, or submit your own file for analysis.