Malicious PDF — malware analysis report

Static analysis result for SHA-256 a38242fe16dfdc79…

MALICIOUS

PDF

194.4 KB Created: 2020-11-06 18:59:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 1e4007413e083f86a47c60538b446959 SHA-1: 2d66bf2f6ebb27b1aac4f30d40a8314cd28b77cb SHA-256: a38242fe16dfdc799306aaf51ad88643083bd0a4f2a983b2b3ec084b8da2bb43
74 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing for a redirector link disguised as a 'free-download phishing' lure, pointing to 'https://trafffi.ru/aws?keyword=redemption+manual+4'. The document body, though heavily obfuscated, also contains this URL. This indicates the file's primary purpose is to trick users into visiting a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 3

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffi.ru/aws?keyword=redemption+manual+4 PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4385216/normal_5f8c92f9d793c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4386609/normal_5f9c99142dfb6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368469/normal_5f8ce156741f0.pdfIn PDF document text
    • https://gojodisob.weebly.com/uploads/1/3/4/6/134664442/5d5a6271e0cde.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368265/normal_5f8afa3a85044.pdfIn PDF document text
    • https://vezutubiwewo.weebly.com/uploads/1/3/4/5/134507618/doxuribiwazamupugozo.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4387410/normal_5f9fd30e2a27f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4446395/normal_5fa109ce89a4d.pdfIn PDF document text
    • https://sizukejagu.weebly.com/uploads/1/3/2/6/132681884/9081031.pdfIn PDF document text
    • https://s3.amazonaws.com/ropuba/rafobofadokatojara.pdfIn PDF document text
    • https://nijubar.files.wordpress.com/2020/11/34126271331.pdfIn PDF document text
    • https://s3.amazonaws.com/wekibik/assassins_creed_3_connor_age.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.