Malicious PDF — malware analysis report

Static analysis result for SHA-256 f084591638e472dc…

MALICIOUS

PDF

14.9 KB Created: 2020-11-09 00:32:47 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-04
MD5: fc323e2a43bb397836ce1fc22a735016 SHA-1: 02dbcdaeba8daad02d166fd9102bcdd39ff11747 SHA-256: f084591638e472dc244465ee41a298c3be0a3e7e6b98ca83c184b938561ef5e2
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as an image-only lure, typical for phishing, designed to trick users into clicking a link. The embedded URL, 'https://traffnew.ru/123?keyword=georgetown+law+application+status+checker', redirects to a page that impersonates a legitimate service to harvest credentials. No scripts were extracted, but the PDF structure and URL strongly indicate a phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 14 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://traffnew.ru/123?keyword=georgetown+law+application+status+checker PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4375885/normal_5f9e229065af3.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4380523/normal_5f9211e73b0fd.pdfIn PDF document text
    • https://zoxuzuxebexot.weebly.com/uploads/1/3/0/9/130969059/jogowezokuvaxu.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404739/normal_5f9897b3b73ba.pdfIn PDF document text
    • https://s3.amazonaws.com/memul/bojevokobagesugifadawil.pdfIn PDF document text
    • https://pilijotapagi.files.wordpress.com/2020/11/nijamuvul.pdfIn PDF document text
    • https://s3.amazonaws.com/vavabi/58988949047.pdfIn PDF document text
    • https://sapifotad.files.wordpress.com/2020/11/desperate_housewives_game_download_free.pdfIn PDF document text
    • https://s3.amazonaws.com/zuses/downloads_games_ps3.pdfIn PDF document text
    • https://s3.amazonaws.com/zetubakuz/64073518884.pdfIn PDF document text
    • https://s3.amazonaws.com/zirojopemup/xosasudalezerun.pdfIn PDF document text
    • https://s3.amazonaws.com/tudawufed/danojoduv.pdfIn PDF document text
    • https://s3.amazonaws.com/bubeto/bandhan_bank_recruitment_application_form.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.