Malicious PDF — malware analysis report

Static analysis result for SHA-256 87be8196b210f813…

MALICIOUS

PDF

39.3 KB Created: 2020-08-19 21:57:10 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-08
MD5: 50934044f4db951ea3bbb8fade13ce73 SHA-1: 932a71c3cd644788bfe3f58c93c404f781c4142e SHA-256: 87be8196b210f813dbf183340e724be8cd3cabd2cad34976b5ff122241ef8b05
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, many of which point to a redirector service (ttraff.cc) that is known to host malicious content. The document body also contains the same lure text and URLs, suggesting an attempt to trick users into downloading potentially harmful files. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=verithanam+video+song++mp4 In PDF document text
    • http://files.tristatemaxedoutwomenspac.org/uploads/1/3/1/3/131382395/vajewoj_wapeka.pdfIn PDF document text
    • http://madadop.discoverdiving.im/uploads/1/3/1/6/131636644/83212e0f.pdfIn PDF document text
    • http://files.4waccessories.com/uploads/1/3/0/7/130740573/6253939.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/5743/9129/files/64865130043.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0434/7016/0032/files/42114742485.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0451/4473/5909/files/caballo_de_troya_2_masada_1986.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/1932/7896/files/1847294989.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0429/9476/1877/files/rowudojemarepidelibete.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0437/7142/9016/files/movovi.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0435/9743/0941/files/861083774.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003eb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EB9 5456 bytes
SHA-256: 392c271cd80788b7d15b6e4ece2f22912d3ce47a3c1d18a545511d2baa18bea6
font_01_sfnt_off0000511b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x511B 2140 bytes
SHA-256: fa98316bad0ee393e4244be63b1d230beb4724cf855be96ad4f2c87a5b302ae2
font_02_sfnt_off00005af4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5AF4 9096 bytes
SHA-256: a8f66b9549de37184bc5594d832f8d3f81ffe6402a22e91f39d67ff6d3c77c8e
font_03_sfnt_off00007a3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A3E 16304 bytes
SHA-256: 8fe31ac2096c5e11ca20e474ac9d4b0e624cd7c6a3d6648e58269b78a2b36287

Open this report in the interactive analyzer, or submit your own file for analysis.