PDF malware analysis — malicious · 6a8e3d25c6237e0b

MALICIOUS

PDF

49.6 KB Created: 2021-02-08 17:03:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: e18741700a31fa8d9461d3ac5854f42e SHA-1: f6824105d581b60ce62123a039766cde4690d684 SHA-256: 6a8e3d25c6237e0b9d827d2b37db4dc52942065f0e30025fecf00aae28a09e57

192 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a link disguised as song lyrics, which redirects to a malicious URL. This is a common phishing tactic to lure users into clicking malicious links. The ML classifier and ClamAV detection further support the malicious nature of this file, indicating it is likely a phishing or trojan delivery mechanism.

Machine Learning

Nyx PDF Classifier malicious score 0.7360

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://yafferge.ru/aws?utm_term=lyrics+brown+skin+girl+by+wizkid In PDF document text
- https://cdn-cms.f-static.net/uploads/4379363/normal_5fdbfb00871e5.pdfIn PDF document text
- http://robolab.one/holt_physics_textbook_solutionsyw8no.pdfIn PDF document text
- https://tebebutak.weebly.com/uploads/1/3/4/7/134744698/lukegimuzo_venilexe_wumutudetuja.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4451927/normal_5ff60b4823ca2.pdfIn PDF document text
- http://xviiivbgz.com/wofapimevijomolosefujajs6ne6.pdfIn PDF document text
- https://jupavovol.weebly.com/uploads/1/3/4/3/134314217/bumuku.pdfIn PDF document text
- https://tupokigefadewun.weebly.com/uploads/1/3/4/7/134702618/1ccd0cdaac.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4464877/normal_5fc8c738c6317.pdfIn PDF document text
- http://astropsychology.site/sogibal5u09.pdfIn PDF document text
- https://muzuxagofonokow.weebly.com/uploads/1/3/1/4/131406885/nimopopabimewera.pdfIn PDF document text
- https://lokanasa.weebly.com/uploads/1/3/5/2/135299929/b332643.pdfIn PDF document text
- http://wownatural.fun/kotafiwalah4l7f.pdfIn PDF document text
- https://womegirig.weebly.com/uploads/1/3/4/5/134506381/midaj.pdfIn PDF document text
- http://helplnstagramcontact6088756.com/nusekitetirulavovubapuradrt6p.pdfIn PDF document text
- https://s3.amazonaws.com/jejulurowev/md5_checksum_tool_windows.pdfIn PDF document text
- https://s3.amazonaws.com/zomuzigo/foguruvol.pdfIn PDF document text
- https://s3.amazonaws.com/dojonuta/acca_p7_examiner_report_september_2017.pdfIn PDF document text
- https://s3.amazonaws.com/safago/driver_network_adapter_laptop_asus_x200ma.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.