PDF malware analysis — malicious · cbefe5c1ecf1c238

MALICIOUS

PDF

32.6 KB Created: 2020-11-04 01:33:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 71bd9518075a13c8dd438c195866ea13 SHA-1: a75a49671a8e036f137370ee5f4d8e7dc686eb42 SHA-256: cbefe5c1ecf1c238a14c94068e8b058a4e835f51633135e452b194ba10e997e6

132 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains heuristics indicating it's a malicious redirector, specifically designed to lure users with a 'click to play game' lure. The embedded URL, https://gettraff.ru/aws?keyword=click+to+play+game, is flagged as malicious and part of a redirector chain. While no scripts were explicitly extracted, the nature of the heuristics and the embedded URL strongly suggest an attempt to lead the user to a malicious site, likely for phishing or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9976

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gettraff.ru/aws?keyword=click+to+play+game In PDF document text
- https://cdn-cms.f-static.net/uploads/4367921/normal_5f8c571450a1e.pdfIn PDF document text
- https://s3.amazonaws.com/nowonovege/projeto_meio_ambiente.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4645ce2a-abbb-4f52-a942-2b5c48f60081/sezafuxopesiwunavi.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d819f980-bce3-4301-bc61-0c8d59e5d47c/18833333512.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bb84c7f8-dfd9-4074-82af-87243fc8461d/2140817191.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9533bf1d-7300-4bf0-89f0-d222796e6804/7084176100.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4bddf16c-cf0a-4586-9370-07e4b8f26155/salotilibevex.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/eea049d4-4629-4772-bb2b-ecd9b19d170a/80611506039.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/870176d0-e445-4526-a9e5-2f4c89d1afc0/28834735694.pdfIn PDF document text
- https://s3.amazonaws.com/regufojalojaza/frequency_doubler_circuit_using_flip_flop.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4652cf26-8cb9-4f7b-a95a-c034dec5106a/16295831272.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5b12e441-0349-46b0-8e91-847e7e2d427d/sigobavu.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a188ee85-fbea-410f-a056-5a95ba131b31/nutrition_through_the_life_cycle_7th.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.