PDF malware analysis — malicious · cb00587bc42c1f37

MALICIOUS

PDF

52.6 KB Created: 2020-12-19 11:34:35 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: dba563b95c37d940930d68ade417ab43 SHA-1: b47a0b0c9a9f36b401f0b5b2a2b2649e377e628c SHA-256: cb00587bc42c1f37b95da42eaeac51199607a74d72b009ee5aa736b99a46a77e

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF file contains numerous external links, identified as a link farm, with a primary URL pointing to a site that appears to be related to beer nutritional information. This suggests a phishing or SEO scam. The ClamAV detection and ML classifier further support its malicious nature. No scripts were extracted, but the structure indicates a malicious intent to redirect users to potentially harmful external sites.

Machine Learning

Nyx PDF Classifier malicious score 0.6926

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://traffnew.ru/aws?utm_term=cerveza+indio+informacion+nutricional PDF link annotation
- https://cdn-cms.f-static.net/uploads/4427504/normal_5fbe19964c53c.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4424982/normal_5fc95e143648d.pdfIn PDF document text
- https://feloxoxux.weebly.com/uploads/1/3/4/0/134000485/1001373.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4460690/normal_5fcea735e85cb.pdfIn PDF document text
- https://pidadilux.weebly.com/uploads/1/3/4/6/134666204/kovolobox.pdfIn PDF document text
- https://jenodefutufute.weebly.com/uploads/1/3/4/3/134373351/wipifotidifon_ziwusedel_jemulivilinune.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4402280/normal_5f9280008dcf5.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4405206/normal_5fab55bd638bb.pdfIn PDF document text
- https://nufewaxitobazat.weebly.com/uploads/1/3/4/7/134748461/sipadifezeviduloga.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4468837/normal_5fd72f73501b8.pdfIn PDF document text
- https://bubixoduxufito.weebly.com/uploads/1/3/1/0/131070588/wirotunujafu-topazitawivava.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/a896b3cc-6e0b-40cd-8aad-78741a53ef8a/43790346791.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/cb353f7c-ff8b-4b46-ba95-14e6abbcf067/cyberlink_powerdirector_14_deluxe.pdfIn PDF document text
- https://s3.amazonaws.com/jazuravazaguz/besito_besito_song.pdfIn PDF document text
- https://s3.amazonaws.com/xamapebonijos/66276852468.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.