Malicious PDF — malware analysis report

Static analysis result for SHA-256 b31e8ae6e7a7ebdc…

MALICIOUS

PDF

44.9 KB Created: 2021-02-27 10:23:05 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: d00531969a95469d89742ea2e459f276 SHA-1: 1fc18d72d36d7bb803b4d350ce98c4f87921102d SHA-256: b31e8ae6e7a7ebdc892888f6969dde21dace835d21df9b0c48ebd55187e0a42e
152 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF containing a link to a known malicious redirector infrastructure. The embedded URL, 'https://yafferge.ru/award?keyword=the+girl+from+ipanema+astrud+gilberto+jo%25C3%25A3o+gilberto+and+stan+getz+lyrics', is highly suspicious and likely serves as a lure for phishing or malware delivery. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5864

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://yafferge.ru/award?keyword=the+girl+from+ipanema+astrud+gilberto+jo%25C3%25A3o+gilberto+and+stan+getz+lyrics In PDF document text
    • https://lugoponogib.weebly.com/uploads/1/3/4/4/134404253/novifovera.pdfIn PDF document text
    • https://cdn.sqhk.co/bigulikexupa/jjqVGhe/pathos_nethack_codex.pdfIn PDF document text
    • http://lalat.space/romeo_and_juliet_1996_soundtrack_volume_2ll00x.pdfIn PDF document text
    • https://mepanomelisegil.weebly.com/uploads/1/3/4/8/134899905/6108376.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426690/normal_60270be39e759.pdfIn PDF document text
    • https://pafuxasakilufa.weebly.com/uploads/1/3/5/3/135327400/penog-lemomu.pdfIn PDF document text
    • https://s3.amazonaws.com/pewebopufupe/rascal_mobility_scooters_for_sale_used.pdfIn PDF document text
    • https://s3.amazonaws.com/gajakelegeza/rodak_hematology_5th_edition_free.pdfIn PDF document text
    • https://s3.amazonaws.com/xovajukoxin/vebudikerijolezanipozir.pdfIn PDF document text
    • https://s3.amazonaws.com/wibedubosateg/bedsheet_sale_singapore.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.