Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c7dbe7eb48d58ac…

MALICIOUS

PDF

53.5 KB Created: 2020-11-04 12:53:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: fb8a8abeb7bd8a42c502ed4b7e218a0c SHA-1: d605c7a5564754b970c6379971d99f8f11680e52 SHA-256: 8c7dbe7eb48d58ac4a73a68b29c117e1b2985524ba516d10c851a7c1837ea7d8
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded links, with a critical heuristic identifying it as a malicious redirector and a link farm. The primary malicious URL, https://gettraff.ru/strik?keyword=forged+by+fire+book+online, is directly linked to known malicious infrastructure. The document body, though heavily obfuscated, contains this URL, suggesting an attempt to disguise its malicious nature as a link to a book.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gettraff.ru/strik?keyword=forged+by+fire+book+online In PDF document text
    • https://cdn-cms.f-static.net/uploads/4384820/normal_5f93fe45b42d4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373997/normal_5f93f82f9b8fb.pdfIn PDF document text
    • https://kilejotiwig.weebly.com/uploads/1/3/1/4/131406519/kerapawenojup.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369927/normal_5f8866ec7f7a9.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371524/normal_5f9017e6cb6d7.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/1932eb74-ecf9-4e88-9190-ea9088aebf96/37403972548.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e2e7b99-a79a-444f-ae68-6f44dceb2c4f/25258161279.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/dfff3372-3eb7-4b95-a8a8-17bd8f306fc5/49115907417.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ce18d148-efe0-43e7-841f-03f309a60ad2/bufudedejarevo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5a1dc8df-fea1-45c3-8307-b91798c87bf8/58636274495.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/70788fc9-5b91-4869-bde9-d187d3f1cdf1/dejipokugigekuzizidekuzo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa5655b4-49a3-4554-82a7-e9b165e9b5e3/29567566877.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/06502603-99ac-4708-8c74-53e90dd51c4b/19514909354.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008805.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8805 4656 bytes
SHA-256: 267728e5a5dee524461382eac46d3541f04a7bc654b5e40b7cec79e7ce1a0616
font_01_sfnt_off000097ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x97EC 10280 bytes
SHA-256: 7e09394424cad1e90e9ddacbfa92129d1049ffa41195be6239b7b6f13fea631d
font_02_sfnt_off0000bb1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBB1D 4324 bytes
SHA-256: 0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333

Open this report in the interactive analyzer, or submit your own file for analysis.