PDF malware analysis — malicious · 9ac01306f01e3dca

MALICIOUS

PDF

18.8 KB Created: 2020-11-02 00:29:57 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 86ada39729bf6453b669ab8153158938 SHA-1: f99a4a5a12de2291b3a0dfffbb509eaba92061d4 SHA-256: 9ac01306f01e3dcab9cb41396c02b21e7a7f39558163cf1186a3e9a27906f690

112 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF is an image-only document designed as a lure, typical of phishing attacks. It contains a critical heuristic firing for a malicious redirector link pointing to 'ttraff.com'. The document body, though heavily obfuscated, includes the same malicious URL, suggesting the primary purpose is to redirect users to potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.9968

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.com/pify?keyword=the+pirate+bay+proxies+mirrors
- https://cdn-cms.f-static.net/uploads/4448124/normal_5f9ed0e554661.pdf
- https://cdn-cms.f-static.net/uploads/4365661/normal_5f9f33b432ba1.pdf
- https://latijazaw.weebly.com/uploads/1/3/4/3/134312978/tajepuvupafexipe.pdf
- https://s3.amazonaws.com/henghuili-files2/17385525469.pdf
- https://s3.amazonaws.com/jepavilutabilel/vowowixurevupafejonasim.pdf
- https://cdn.shopify.com/s/files/1/0495/7565/7624/files/jetofateba.pdf
- https://s3.amazonaws.com/henghuili-files2/12294169168.pdf
- https://cdn.shopify.com/s/files/1/0482/6985/2833/files/being_alone_quotes_positive.pdf
- https://s3.amazonaws.com/davolazupivowi/bosemugerumaku.pdf
- https://s3.amazonaws.com/jasadavebaga/wegetuxosinezadefini.pdf
- https://cdn.shopify.com/s/files/1/0491/9780/9830/files/boarding_pass_android_wallet.pdf
- https://cdn.shopify.com/s/files/1/0502/8842/7181/files/xeturulojez.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.