Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c81584201b522b6…

MALICIOUS

PDF

61.3 KB Created: 2021-02-27 01:02:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 63565c1356e5db5557699a216a43774f SHA-1: d1b25c736a6caae79a561cd77fe3afbc8104058c SHA-256: 4c81584201b522b6cfc18c96c7a284076b62945e6b0d1700f505831c98e5704b
242 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple critical heuristics as a malicious redirector and link farm. It contains numerous embedded URLs, with a primary redirector pointing to 'https://dafemum.ru/award?keyword=garmin+nuvi+2595+price'. The document body, though heavily obfuscated, appears to contain metadata related to product pricing, suggesting a lure for phishing or malware distribution. No scripts were extracted, but the extensive use of malicious URLs indicates a high likelihood of redirection to harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9514

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/award?keyword=garmin+nuvi+2595+price In PDF document text
    • http://zugasanuko.getenjoyment.net/xulesorezu.pdfIn PDF document text
    • https://mujurusema.weebly.com/uploads/1/3/4/8/134846640/dopobi_jimiduxidas_gevetovano_nenumig.pdfIn PDF document text
    • https://tagopudul.weebly.com/uploads/1/3/5/3/135392217/23ac71a7908c.pdfIn PDF document text
    • https://lopamazaveseku.weebly.com/uploads/1/3/4/6/134643240/kames.pdfIn PDF document text
    • https://xomitemekebok.weebly.com/uploads/1/3/4/8/134881854/xibowi-weraluliw.pdfIn PDF document text
    • http://sitebomobegux.sportsontheweb.net/84946761708.pdfIn PDF document text
    • https://naluzakagowu.weebly.com/uploads/1/3/1/4/131411806/3783361.pdfIn PDF document text
    • http://juwupexutaval.mywebcommunity.org/the_night_manager_netflix_uk.pdfIn PDF document text
    • http://mananeje.66ghz.com/jubiku.pdfIn PDF document text
    • http://puxekera.22web.org/5768064564.pdfIn PDF document text
    • https://sovevalejuwup.weebly.com/uploads/1/3/1/8/131858043/4936817.pdfIn PDF document text
    • http://rowowesofazov.medianewsonline.com/18562933614.pdfIn PDF document text
    • http://sugameloxufe.mywebcommunity.org/does_the_lexus_hybrid_require_premium_gas.pdfIn PDF document text
    • http://pexawegowe.mywebcommunity.org/61385466659.pdfIn PDF document text
    • https://gejilesiwurulu.weebly.com/uploads/1/3/4/3/134374779/1143015.pdfIn PDF document text
    • http://xepidenad.scienceontheweb.net/lemizaror.pdfIn PDF document text
    • http://zejibanunepi.myartsonline.com/63939662924.pdfIn PDF document text
    • https://s3.amazonaws.com/mukut/enter_answer_using_interval_notation.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.