PDF malware analysis — malicious · ab3d4afe0187f228

MALICIOUS

PDF

49.6 KB Created: 2021-02-06 09:40:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 45bc20d9c3f78beeac619e163dc573ea SHA-1: 3249f215e76e48dce6a857acb45aca1aa4507a04 SHA-256: ab3d4afe0187f22836df10ff6173accfa33d6a1718b45737481409dbf6dbd612

194 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many pointing to PDFs hosted on S3 buckets and Weebly, suggesting a link farm or SEO poisoning tactic. One prominent URL, 'https://bologen.ru/aws?utm_term=best+android+tv+browser+2018', is identified as an SEO redirector, likely used for phishing or malware delivery. ClamAV also detected this file as 'Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0', reinforcing its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9443

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://bologen.ru/aws?utm_term=best+android+tv+browser+2018 PDF link annotation
- https://ledegukumimajem.weebly.com/uploads/1/3/5/3/135393042/d80e604c5.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4466680/normal_6009942bf348d.pdfIn PDF document text
- https://towowiwegopute.weebly.com/uploads/1/3/4/0/134019464/mafirologowe_genigukokekafe_nufuluzakal.pdfIn PDF document text
- https://katifakemu.weebly.com/uploads/1/3/1/3/131381151/wuluxawarulowegibal.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4421966/normal_5ff25e6ea06e7.pdfIn PDF document text
- https://nezivubu.weebly.com/uploads/1/3/1/3/131384481/nurafemomiwi.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4366041/normal_5fd6651d4c952.pdfIn PDF document text
- https://zepafasamog.weebly.com/uploads/1/3/4/3/134361306/vidotosinos-lajaluve-nanebil.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4404528/normal_5fe3a8bc70af7.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4365536/normal_5ff53f2d7d22e.pdfIn PDF document text
- https://natesikapepik.weebly.com/uploads/1/3/4/7/134750077/58de43c.pdfIn PDF document text
- https://s3.amazonaws.com/jajuzasalikirut/naritu.pdfIn PDF document text
- https://s3.amazonaws.com/peveziwoguxuzam/60038797318.pdfIn PDF document text
- https://s3.amazonaws.com/vawoginele/vsco_apk_full_unlocked_2018_ios.pdfIn PDF document text
- https://s3.amazonaws.com/domegagowevag/formas_de_aprender_ingls_fcil_y_rpido.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.