Malicious PDF — malware analysis report

Static analysis result for SHA-256 f23da2bb2164c30a…

MALICIOUS

PDF

49.6 KB Created: 2020-11-22 00:09:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: fd4c99dcfb93f72b9b28159381023418 SHA-1: 160e0566e565df98ed5a51ed7be39f4eb376b491 SHA-256: f23da2bb2164c30aa1ea2ec48e2fea6d56368d29843f55d800e7cf19e742c6ef
154 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains numerous external links, a technique often used for SEO manipulation or to redirect users to malicious sites. One prominent URL, 'https://trafficel.ru/aws?utm_term=format+factory+setup+file+free', suggests a phishing or malware distribution attempt disguised as a software download. The ClamAV detection and ML classifier further support its malicious nature, indicating it's likely a phishing or trojan delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7011

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=format+factory+setup+file+free PDF link annotation
    • https://peroleliviw.weebly.com/uploads/1/3/4/6/134648746/jonemo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/095ee298-ac63-4d17-ad8f-2956de80cd99/gapurusotej.pdfIn PDF document text
    • https://s3.amazonaws.com/nazekisigiduz/gigabyte_ga-970a-ds3p_fx_specs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9c9b8967-bf18-4270-8b96-d6570a3767e1/5232276672.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0fd5c350-4480-4749-afd1-134d4628fa46/doduxet.pdfIn PDF document text
    • https://s3.amazonaws.com/juzinaramip/chota_bheem_speed_racing_game.pdfIn PDF document text
    • https://s3.amazonaws.com/luropi/holiday_brilliant_lights_instruction_manual.pdfIn PDF document text
    • https://s3.amazonaws.com/tevigotu/94141719986.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/18c03a59-53ea-4c4c-8f22-6327a9ef2237/16131603751.pdfIn PDF document text
    • https://s3.amazonaws.com/lorerexeg/how_to_go_back_in_piskel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b97afbb2-3d7d-4646-929e-615102d89582/3902519037.pdfIn PDF document text
    • https://s3.amazonaws.com/banula/basoporo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/59776c21-795d-4055-99b9-a6659543eb7e/gapawamuzifulafapij.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ebded87e-b2a8-4f7f-b4b1-9fa86bf36d81/vawofexe.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.