PDF malware analysis — malicious · cfbbadbfe3f629be

MALICIOUS

PDF

52.6 KB Created: 2021-01-02 12:58:54 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: b8063ab07e9976b5871e7380c3d35593 SHA-1: 60d8561524346424279ddeea0dab53412a5d4dfa SHA-256: cfbbadbfe3f629bea580f8520b42f7c38cfba7c1679ba32a2faab16ff95eaa72

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a critical heuristic firing indicating it links to known malicious redirector infrastructure. The embedded URL 'https://traffmen.ru/aws?utm_term=auto+dialer+di+android' is identified as a potential threat. ClamAV also detected the file as 'Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0', further supporting a malicious classification.

Machine Learning

Nyx PDF Classifier malicious score 0.6487

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffmen.ru/aws?utm_term=auto+dialer+di+android In PDF document text
- https://cdn-cms.f-static.net/uploads/4379854/normal_5f91b862c8434.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4411921/normal_5fa324c15c851.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416514/normal_5fa3cc25b62df.pdfIn PDF document text
- https://s3.amazonaws.com/wixatax/27180991813.pdfIn PDF document text
- https://s3.amazonaws.com/xuxifuzituwu/49824665579.pdfIn PDF document text
- https://s3.amazonaws.com/rozebofukixus/panchatantra_moral_stories_in_telugu.pdfIn PDF document text
- https://s3.amazonaws.com/gagagakigibapo/78034768066.pdfIn PDF document text
- https://s3.amazonaws.com/ginutu/sometimes_alcohol_is_the_answer_t_shirt.pdfIn PDF document text
- https://s3.amazonaws.com/vapelurowar/93452770856.pdfIn PDF document text
- https://s3.amazonaws.com/jeduzizonox/simaven.pdfIn PDF document text
- https://s3.amazonaws.com/baxegezivumi/lumalupimapanal.pdfIn PDF document text
- https://s3.amazonaws.com/jotizifime/coordinate_plane_quadrant_1.pdfIn PDF document text
- https://s3.amazonaws.com/tiluwisulepam/read_brain_on_fire.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.