Malicious PDF — malware analysis report

Static analysis result for SHA-256 f39d903d67b2760c…

MALICIOUS

PDF

48.0 KB Created: 2020-10-23 21:16:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 8c7b67d7fbc6f0627feccad4e603e1b0 SHA-1: a73fd046b0794ad7283cd90ffa312aa19b68cd91 SHA-256: f39d903d67b2760cea063fafddf1dc920a3878795e726cfffc5c55b29a815281
132 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a link disguised as a payslip, which redirects to the URL https://ttraff.cc/123?keyword=exemple+fiche+de+paie+vierge+pdf. This URL is flagged as a malicious redirector, indicating a phishing or malware distribution attempt. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/123?keyword=exemple+fiche+de+paie+vierge+pdf In PDF document text
    • https://cdn-cms.f-static.net/uploads/4375353/normal_5f8dfd2b8e8ea.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4367297/normal_5f880319e4df9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/72016197987.pdfIn PDF document text
    • https://s3.amazonaws.com/xanebavifamopez/20780054163.pdfIn PDF document text
    • https://s3.amazonaws.com/felasorarabipis/la_amenaza_del_cambio_climatico_libro.pdfIn PDF document text
    • https://s3.amazonaws.com/fowikorejodi/guxapeneduxidoruripazoko.pdfIn PDF document text
    • https://s3.amazonaws.com/wilugugo/17488239789.pdfIn PDF document text
    • https://s3.amazonaws.com/forupokisip/18716275581.pdfIn PDF document text
    • https://s3.amazonaws.com/jamokaroxoj/mozojazega.pdfIn PDF document text
    • https://s3.amazonaws.com/fuwawibu/89808934094.pdfIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/66441020855.pdfIn PDF document text
    • https://s3.amazonaws.com/gupuso/89382488616.pdfIn PDF document text
    • https://s3.amazonaws.com/banula/importance_of_baseline_survey.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files2/agilmente_ejercicios_mentales.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a0a0682c-3136-4b33-a89a-952f85b96407/2379821157.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2002bb8f-9186-4918-a0bf-9db9711d57ae/nuvufafinejel.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/62c56393-d8ad-401b-bc2f-5a5193263f2d/amazon_fire_6.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8b400011-636a-4f73-9f66-56303a385c72/java_invertir_una_cadena.pdfIn PDF document text
    • https://s3.amazonaws.com/regufojalojaza/32111265836.pdfIn PDF document text
    • https://s3.amazonaws.com/zuxadol/62167249476.pdfIn PDF document text
    • https://s3.amazonaws.com/pazifetanegapu/37511690929.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000085dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85DC 5476 bytes
SHA-256: cd076a159fa04037a1e0d2b67a556edcc69b538fdc57a1f417d5ee9b612c4bf6

Open this report in the interactive analyzer, or submit your own file for analysis.