PDF malware analysis — malicious · f15a9084f19fcdb6

MALICIOUS

PDF

41.6 KB Created: 2021-01-10 09:18:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: a2112b9ab99a84c9b104e52dc28d80a0 SHA-1: e4661c4ec26f37e331b6360b0a2b4ce33a005ec9 SHA-256: f15a9084f19fcdb648d66333a193579bcc2d7def9e20ac260cf3362ff23ba105

74 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains a heuristic indicating it's an SEO redirector link, disguised as a free download lure. This link points to 'https://trafficel.ru/aws?utm_term=15+meter+beep+test+free', which is likely used to deliver a malicious payload or conduct phishing. No scripts were extracted, but the presence of a redirector strongly suggests a malicious intent to lure users to a compromised site.

Machine Learning

Nyx PDF Classifier malicious score 0.5579

Heuristics 3

Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://trafficel.ru/aws?utm_term=15+meter+beep+test+free PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.