PDF malware analysis — malicious · df8bcbfd75244ee3

MALICIOUS

PDF

58.6 KB Created: 2021-02-26 02:12:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 9bd2f462a5b6d6fee0c87adaae01a4ac SHA-1: e1570335ac2fe814ca575992f21498aa58a60e3f SHA-256: df8bcbfd75244ee3b26dab3e08634977f85bd4c1ef54c1b6f592449a45a30d0c

184 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a significant number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links likely serve as a link farm, redirecting users to various external sites. The ClamAV detection and ML classifier also flag this PDF as malicious, suggesting it is part of a phishing or malware distribution scheme. The primary attack pattern observed is the use of a link farm to direct users to potentially harmful content.

Machine Learning

Nyx PDF Classifier malicious score 0.7109

Heuristics 5

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/award?keyword=academic+writing+definition+and+its+features PDF link annotation
- https://kopusitubo.weebly.com/uploads/1/3/4/6/134698796/7398224.pdfIn PDF document text
- https://murimuwisoruda.weebly.com/uploads/1/3/4/0/134017177/zitizef.pdfIn PDF document text
- https://xogowabixebeva.weebly.com/uploads/1/3/4/6/134612916/lositafi.pdfIn PDF document text
- https://wojemalivameju.weebly.com/uploads/1/3/0/7/130775107/4d897edd24.pdfIn PDF document text
- https://girowotejetut.weebly.com/uploads/1/3/1/4/131406843/de4c6cb4229ef.pdfIn PDF document text
- https://lefonoduri.weebly.com/uploads/1/3/5/3/135324857/7491236.pdfIn PDF document text
- http://punavuvipufov.sportsontheweb.net/7555577431.pdfIn PDF document text
- http://pezidibega.iblogger.org/tuwerifamumarelagu.pdfIn PDF document text
- http://zalofamanaw.22web.org/define_chairman_s_report.pdfIn PDF document text
- http://xepomujix.22web.org/weather_report_bathurst_saturday.pdfIn PDF document text
- http://sojeveme.epizy.com/40974433624.pdfIn PDF document text
- http://batogejupimole.rf.gd/sobifebesixazuviletaxi.pdfIn PDF document text
- http://jozobudesurarab.onlinewebshop.net/what_does_maladjusted_mean_in_a_sentence.pdfIn PDF document text
- http://gepowux.rf.gd/brahmanic_and_shramanic_traditions.pdfIn PDF document text
- http://lojabupabavize.onlinewebshop.net/oraciones_en_pasado_simple_con_verbos_irregulares_y_regulares_en_ingles.pdfIn PDF document text
- http://petilawunabebi.epizy.com/wokejefobexakogavosobizi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.