Malicious PDF — malware analysis report

Static analysis result for SHA-256 f08a57349bf8398b…

MALICIOUS

PDF

57.0 KB Created: 2021-02-20 09:49:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: 4c1afd4e5571e422079239913ebcd57c SHA-1: 8036c99edddffd9c40b48e920640c59785a0e724 SHA-256: f08a57349bf8398b3cd997b3773850dad95f4a84860cfdb314145c084d49b198
194 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous external links, many of which point to S3 buckets and Weebly-hosted PDFs, suggesting a link farm for SEO manipulation. The primary lure URL, 'https://maypoin.ru/strik?utm_term=how+to+use+panasonic+lumix+g85+as+webcam', is identified as an SEO redirector. ClamAV detected this file as 'Pdf.Phishing.Trojan', indicating a phishing or malicious intent. No scripts were extracted, but the structure and URL patterns are indicative of a phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6699

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
    PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://maypoin.ru/strik?utm_term=how+to+use+panasonic+lumix+g85+as+webcam PDF link annotation
    • https://vojizozovogimum.weebly.com/uploads/1/3/0/7/130740342/vitatamuvex_roxizuted.pdfIn PDF document text
    • https://lagonola.weebly.com/uploads/1/3/4/8/134851586/c4d9c4d8d3417f.pdfIn PDF document text
    • https://cdn.sqhk.co/pevizopubok/dEMTjiO/monkey_shoulder_batch_27_vs_original.pdfIn PDF document text
    • http://vipodesin.22web.org/boolean_algebra_theorems.pdfIn PDF document text
    • https://goxepafanaba.weebly.com/uploads/1/3/0/7/130739763/xilimofegu-zobugizixi-falakufugu-mipuxalisetir.pdfIn PDF document text
    • https://tamipabofoj.weebly.com/uploads/1/3/4/8/134876193/rogil.pdfIn PDF document text
    • https://safusugefivelu.weebly.com/uploads/1/3/4/3/134346528/f38cc6d115.pdfIn PDF document text
    • https://webolubodu.weebly.com/uploads/1/3/0/9/130969971/7e293dc43.pdfIn PDF document text
    • https://s3.amazonaws.com/godewumazek/poxekikepajoxisaziweb.pdfIn PDF document text
    • https://s3.amazonaws.com/bomifabipi/canal_carpien_acupuncture.pdfIn PDF document text
    • https://s3.amazonaws.com/mukut/metroid_prime_4_delayed_reddit.pdfIn PDF document text
    • https://s3.amazonaws.com/jasadavebaga/avast_battery_saver_apk_uptodown.pdfIn PDF document text
    • https://s3.amazonaws.com/jebokizez/periodic_table_crossword_puzzle-_advanced_answers.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.