PDF malware analysis — malicious · 8a043ca647fc1f5e

MALICIOUS

PDF

10.8 KB Created: 2020-10-28 00:17:34 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 2c44cfa65f6afa7db8531a2ec9640b6b SHA-1: 378514474aabfbcc60cf4bb6a623df354c376f3f SHA-256: 8a043ca647fc1f5ed9da2e545135fb5a30ae83ac473cd85fa2e2a9fc53cd6ae9

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is an image-only document designed as a lure, containing a single clickable link that redirects to a known malicious infrastructure. The ML classifier strongly indicates maliciousness. The embedded URL is the primary indicator of a phishing or scam attempt, likely leading to a credential harvesting page or further malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9941

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 10 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.cc/pify?keyword=imperialism+document+based+question+answers In PDF document text
- https://s3.amazonaws.com/nupotukig/75183074419.pdfIn PDF document text
- https://s3.amazonaws.com/zomuzigo/20926948707.pdfIn PDF document text
- https://s3.amazonaws.com/jakujakula/9379065504.pdfIn PDF document text
- https://s3.amazonaws.com/henghuili-files2/lututoxixabixutoron.pdfIn PDF document text
- https://s3.amazonaws.com/bidivo/lujorewexokasipubine.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.