Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff793395e991cf08…

MALICIOUS

PDF

50.6 KB Created: 2021-01-04 01:43:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 4d623160e081c14f8d6925f8e4f3d4f3 SHA-1: 04d3839b2512fe279a0d0d7cf70323d2ba4c8a42 SHA-256: ff793395e991cf083a69f922d363cb53f405320f44955c3f2882ac17137590f9
134 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains heuristics indicating it is a phishing lure, specifically using an image to redirect users to a malicious URL. The ClamAV detection and ML classifier further support its malicious nature. The embedded URL 'https://trafffe.ru/aws?utm_term=food+handlers+answers+2018' is the primary indicator of compromise, likely leading to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7328

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/aws?utm_term=food+handlers+answers+2018 PDF link annotation
    • https://cdn.sqhk.co/nazabimon/jhdjg86/guide_money_maker_3d_print_cash_apk.pdfIn PDF document text
    • https://cdn.sqhk.co/poxudanefisi/Jibhchc/fruit_logistica_2020_tickets.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4421613/normal_5fdc56983311b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4405202/normal_5ff218437bcb8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4415770/normal_5fc6c89d4f8df.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4455396/normal_5fadd1db5cd39.pdfIn PDF document text
    • https://cdn.sqhk.co/pigalixow/ejixqhb/critical_ops_online_multiplayer_fps_shooting_games.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387709/normal_5fcfadc27e759.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files/cache_only_memory_architecture.pdfIn PDF document text
    • https://s3.amazonaws.com/juliziwojatige/van_turkey_hotel.pdfIn PDF document text
    • https://s3.amazonaws.com/rebomedug/dafetaf.pdfIn PDF document text
    • https://s3.amazonaws.com/jexijer/buzofuloxutixomeb.pdfIn PDF document text
    • https://s3.amazonaws.com/paropabaru/bharat_full_movies_watch_online.pdfIn PDF document text
    • https://s3.amazonaws.com/daselex/athens_area_school_district_pa_employment.pdfIn PDF document text
    • https://s3.amazonaws.com/wupiwupiwot/adding_integers_practice.pdfIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.