Malicious PDF — malware analysis report

Static analysis result for SHA-256 9739bf5c6d2bea34…

MALICIOUS

PDF

52.6 KB Created: 2021-01-03 03:54:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 81c9696a4702654c959c480f45199ef3 SHA-1: 0138d6403e687a4d8c02032a7c3bcac29a05e0d4 SHA-256: 9739bf5c6d2bea34a5d83640273740f08e62138fef1d02f28eea7799d3929a3a
160 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link to a known malicious redirector, ggtraff.ru, which is disguised as a download for 'Autodesk homestyler crackeado'. This suggests a phishing or malware distribution attempt. While no scripts were explicitly extracted, the ML classifier and ClamAV detection indicate malicious intent, likely involving a redirect to a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6791

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • SEO-redirector lure link (multi-word utm_term) low PDF_SEO_UTM_REDIRECTOR_LINK
    PDF contains a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the search-keyword gateway used by the 'free document download' phishing family. Surfaced as an IOC; on its own this is a low-confidence signal.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ggtraff.ru/aws?utm_term=autodesk+homestyler++crackeado In PDF document text
    • https://cdn-cms.f-static.net/uploads/4493282/normal_5fd0b568e5e93.pdfIn PDF document text
    • https://cdn.sqhk.co/forokuxodel/RPZ9k4O/relarozezupane.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374956/normal_5fecea4d976a6.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425235/normal_5fddd31de0efc.pdfIn PDF document text
    • https://nuvisinuxaxo.weebly.com/uploads/1/3/1/3/131383681/8446245.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4457320/normal_5fd8154d190a9.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4481173/normal_5fcc2c6a3bc4a.pdfIn PDF document text
    • https://s3.amazonaws.com/nufidibodudulad/20830589016.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/38e227da-a480-4a64-b8f8-aea5b1b12717/netflix_account_generator_telegram.pdfIn PDF document text
    • https://s3.amazonaws.com/gurowozenupifi/76420897480.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e2a2d10-6b47-4f2f-8560-3f1713d021ac/fotulusudegipabijegurif.pdfIn PDF document text
    • https://s3.amazonaws.com/zaxuledo/11_standard_online_admission_form_maharashtra.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c32c1335-c3cb-45f2-bdb9-f8120a3667f4/dgt_chess_board_review.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.