PDF malware analysis — malicious · ab279256d45af498

MALICIOUS

PDF

41.4 KB Created: 2020-10-23 09:19:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 3f51f98f2cabbfe31c1f81212a781868 SHA-1: 7b63e764a75713e66798129dc07eec65669b6b2b SHA-256: ab279256d45af49832f15f2268e4798c3eebb37f73f97b2caae04212e193b03c

192 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains multiple heuristics indicating it is a malicious redirector, specifically designed to lead users to a malicious URL. The document body, though heavily obfuscated, contains the malicious URL 'https://cctraff.ru/aws?keyword=armed+conflict+pdf' and several other PDF links, suggesting a link farm or phishing lure. The ML classifier strongly supports the malicious verdict.

Machine Learning

Nyx PDF Classifier malicious score 0.9984

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://cctraff.ru/aws?keyword=armed+conflict+pdf In PDF document text
- https://cdn-cms.f-static.net/uploads/4375518/normal_5f8b82af1ba8c.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367308/normal_5f88a0956deef.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369788/normal_5f9011788aca8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387702/normal_5f8e816ee6dd8.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366351/normal_5f87308061bec.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4369933/normal_5f8d965ac084f.pdfIn PDF document text
- https://vebifejelib.weebly.com/uploads/1/3/0/7/130775119/74ebf2fbb4.pdfIn PDF document text
- https://fakimodixoto.weebly.com/uploads/1/3/0/7/130739088/rejetidojukes-fuvejapupe-ruluxoxivek-xofavigunof.pdfIn PDF document text
- https://finiluxexolije.weebly.com/uploads/1/3/1/8/131856594/subunolumevasez.pdfIn PDF document text
- https://zalopajozi.weebly.com/uploads/1/3/1/4/131453352/zoxorujepaxawijavone.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/18aa71f0-4df6-4fe9-a668-8bfa4fccdd70/relasetelekovesovogowogo.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/50f65110-ea04-4795-b07c-dccb0893713b/merur.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7dbb0f72-dcd7-45a2-8500-5e37c80de599/tifibekamefus.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/59610095-a385-4ab4-b9c2-9e8e9617bfb6/jufowiwuvigigaj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/3f8070d3-3263-46b9-bafe-138dff297f5e/17286024751.pdfIn PDF document text
- https://s3.amazonaws.com/kiwopusafize/manual_de_barras_de_access_consciousness.pdfIn PDF document text
- https://s3.amazonaws.com/mijedusovineti/alexander_s_empire.pdfIn PDF document text
- https://s3.amazonaws.com/henghuili-files/xukekijikamenumipimuwezoj.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4c0f2aed-8bdf-4aae-a76e-5098cb8de426/79130907247.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/fbefc574-10eb-4b2d-a585-a47912e908ec/el_poder_del_esposo_que_ora_libro.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/49da04ff-20db-4159-b10c-2b87e10c273a/dutaninerax.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006c8e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6C8E	4688 bytes
SHA-256: `e936774f8c08c66c059b5fb54597994952484b6ea17d16a028746c6e31838dae`
`font_01_sfnt_off00007c4e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C4E	9444 bytes
SHA-256: `6927c77e45876d4c25c8db5a23e40e3c4323857119b4dd922bb438c9299a350d`

Open this report in the interactive analyzer, or submit your own file for analysis.