Malicious PDF — malware analysis report

Static analysis result for SHA-256 acfd482db52daa60…

MALICIOUS

PDF

42.3 KB Created: 2020-09-17 10:45:41 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-05-09
MD5: bd724f7d71074456e7b1ceccbc11bd23 SHA-1: fdb1030eacaad5e3b2f62dbc83fe32f2fe97bf50 SHA-256: acfd482db52daa609bb4a2937bd94603d559a1df65f26270329b1ddf5a036dcf
184 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple critical heuristics for containing a malicious redirector link and a large link farm. The embedded URL 'https://ttraff.link/wix?keyword=5e+water+genasi+names' is identified as a malicious redirector. The document body, though heavily obfuscated, also contains this URL and numerous other PDF links, suggesting a coordinated effort to distribute malicious content through a link farm. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.link/wix?keyword=5e+water+genasi+names In PDF document text
    • http://wowufodes.healingnotesllc.com/uploads/1/3/1/4/131408172/90779.pdfIn PDF document text
    • http://files.magnificentheavens.com/uploads/1/3/0/9/130969265/rakemar.pdfIn PDF document text
    • http://files.jmplaser.com/uploads/1/3/0/9/130969489/3541420.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://42c45dc6-f9ef-4886-b51b-e0f17296c2d0.filesusr.com/ugd/dc6899_0111a42170eb4c219669d37628e2fc27.pdf?index=trueIn PDF document text
    • https://4ffb9bb3-1194-46b1-8912-e07bb8e9a44a.filesusr.com/ugd/229b11_8c2cf5596f0d4428b12ea982a2b9ebc5.pdf?index=trueIn PDF document text
    • https://d394c4d4-aeea-4299-bf5c-65aa823ca4de.filesusr.com/ugd/135178_edf491b056df4a9690346d2222ce88ef.pdf?index=trueIn PDF document text
    • https://5a5ff6ac-bc70-4f48-b734-c39ec7bb1b7d.filesusr.com/ugd/5a4aad_a865b3e1390443658bbb418265b1621d.pdf?index=trueIn PDF document text
    • https://e2bdb461-3c94-433d-8b4a-59879a91bbd1.filesusr.com/ugd/bdc04d_0aa58c0945a341c7b8bd4788e1e66517.pdf?index=trueIn PDF document text
    • https://ee87493f-4587-4948-80d9-06c8183028da.filesusr.com/ugd/8e66a5_3175097a0ac8472b8cf672bad9269d82.pdf?index=trueIn PDF document text
    • https://ee850b6c-8737-4163-b4c5-24929de39e0b.filesusr.com/ugd/162fe6_0290de4c942e4fb4b4da67d6d79f0155.pdf?index=trueIn PDF document text
    • https://fe522fbe-15a9-4c40-8947-7679140b94e7.filesusr.com/ugd/135178_d14882f57bb44fcdb315c7cc40afdb38.pdf?index=trueIn PDF document text
    • https://5ded3e8b-d2a2-403b-855d-dcf9c725d984.filesusr.com/ugd/65b209_228d8e745bf242bbb946500795959254.pdf?index=trueIn PDF document text
    • https://cdn.shopify.com/s/files/1/0446/3457/0915/files/agenesia_de_corpo_caloso.pdfIn PDF document text
    • https://cdn.shopify.com/s/files/1/0440/2610/1910/files/ruvitekalokatajumoxadu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000695d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x695D 5096 bytes
SHA-256: 7473d28e4fc9236bd48d0929bacbc2a288a51dd216ae30e6d969bf622d71460b
font_01_sfnt_off00007aaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7AAF 9948 bytes
SHA-256: 71ed135992230c105549c900583aaf6b7ac485c6951f9812cf6d38f474ecd229

Open this report in the interactive analyzer, or submit your own file for analysis.