PDF malware analysis — malicious · 5fe34dc5a6153c55

MALICIOUS

PDF

49.0 KB Created: 2021-02-28 09:20:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 4c04f5f6da4c017b1dd64f64b5465905 SHA-1: 0cbcf509fd401297123b9495439d1c78f7c29788 SHA-256: 5fe34dc5a6153c5518b50fbb09567c656e46cea7f1e70aef94bbe5ea9d8b93be

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains heuristics indicating it is a phishing lure, specifically using an image to redirect users to a malicious URL. The ClamAV detection further supports its malicious nature. The embedded URL and the document's presentation suggest an attempt to trick users into downloading further malicious content or visiting a phishing site.

Machine Learning

Nyx PDF Classifier malicious score 0.7606

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://vilenefex.ru/award?keyword=charla+de+seguridad+de+5+minutos+covid+19 PDF link annotation
- https://cdn.sqhk.co/sujubowip/ajcohiQ/xodatutoluduvopetobamino.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4496816/normal_5feb0535257bc.pdfIn PDF document text
- https://cdn.sqhk.co/kixobaza/bhfjdfT/dire_wolf_hd_wallpapers_4k.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4482190/normal_5ff8965dba708.pdfIn PDF document text
- http://hookup666.site/biografia_de_augusto_monterrosota3tq.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4505125/normal_600f166cea0ba.pdfIn PDF document text
- https://cdn.sqhk.co/tinulafi/ogehjgj/timapidoza.pdfIn PDF document text
- https://cdn.sqhk.co/zurajekiviw/jaigFgd/gift_cash_app.pdfIn PDF document text
- http://photoforce.ru/core_teaching_skills797lv.pdfIn PDF document text
- https://cdn.sqhk.co/poladejug/bjagfp6/90755021215.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4451356/normal_60158cc26b66b.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4484364/normal_6017426893476.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4447464/normal_6022d9d18d9c5.pdfIn PDF document text
- https://cdn.sqhk.co/dupeguwova/jpieraf/1671200010.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4387406/normal_60260c5c2483a.pdfIn PDF document text
- https://cdn.sqhk.co/mixaluwekitu/jipihLG/wumupapegalosukovope.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4416512/normal_5fe9eaf0d2d60.pdfIn PDF document text
- https://cdn.sqhk.co/molavagew/jit7mgg/21932627446.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4484093/normal_5ffa6e609021f.pdfIn PDF document text
- https://cdn.sqhk.co/fugolamudara/jjhdhiS/89941822088.pdfIn PDF document text
- https://cdn.sqhk.co/rawerusiwala/D8giJqg/menamesurojemoze.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.