PDF malware analysis — malicious · 7a468e64e28451e3

MALICIOUS

PDF

70.9 KB Created: 2021-02-24 23:50:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 75a2067afa4269b2d8b1a6291000526a SHA-1: 9b9fddf0cd60a8df7b40779446066c7d281bbbc3 SHA-256: 7a468e64e28451e3b5e0147aaf715b19ed975aaa549a89f46ff19f9f961372ca

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF file contains a lure related to a generator spark plug, which redirects to the URL https://maypoin.ru/award?keyword=yamaha+ef1000+generator+spark+plug. This URL is flagged as a redirector for phishing and potentially malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or delivering a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9668

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://maypoin.ru/award?keyword=yamaha+ef1000+generator+spark+plug PDF link annotation
- https://static.s123-cdn-static.com/uploads/4494875/normal_5ff7a0e21c1fd.pdfIn PDF document text
- http://retys.space/church_anniversary_flyer_templates_freeuage9.pdfIn PDF document text
- http://podarokinsta365.site/maxiw9bgd6.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4408170/normal_5fe7332000d03.pdfIn PDF document text
- http://pozuliruz.iblogger.org/letter_e_handwriting_sheet.pdfIn PDF document text
- http://ragexerate.22web.org/mojinokivanapifofimejiji.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/gogonof/vexoripunuwaruvudobex.pdfIn PDF document text
- https://s3.amazonaws.com/panokojol/tepitajuv.pdfIn PDF document text
- https://s3.amazonaws.com/posufij/balak_palak_marathi_movie_300mb.pdfIn PDF document text
- https://s3.amazonaws.com/bakoloj/baltimore_city_circuit_court_subpoena_form.pdfIn PDF document text
- http://goseletew.epizy.com/goroveji.pdfIn PDF document text
- https://s3.amazonaws.com/wegugus/48554608105.pdfIn PDF document text
- https://s3.amazonaws.com/fidefofudi/surore.pdfIn PDF document text
- https://s3.amazonaws.com/bepukuba/depojotemuvebavozasabo.pdfIn PDF document text
- https://s3.amazonaws.com/bipovoromoj/40496714501.pdfIn PDF document text
- http://kidagemomosate.epizy.com/airport_codes_worldwide.pdfIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000edba.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEDBA	5536 bytes
SHA-256: `e238bdb0ba73b5003a7e8af730e1d55654789f0c343a6280f6b250c67b2d6f29`

Open this report in the interactive analyzer, or submit your own file for analysis.