Malicious PDF — malware analysis report

Static analysis result for SHA-256 1eb32016c936d6f2…

MALICIOUS

PDF

50.6 KB Created: 2020-11-19 16:42:04 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: e4637b457c8614bf591623b9d2de7809 SHA-1: c0ba81a965a9f6df697bf74b605a2c100e55025a SHA-256: 1eb32016c936d6f28d4fe656b6a5b7bdf3de860a624fb28706fbc8a9dc4b8cdb
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a lure related to "the perfect pistol shot" and embeds a URL pointing to a suspicious domain. ClamAV and ML heuristics also flagged this file as malicious, indicating a phishing or trojanized document. No scripts were extracted, but the embedded URI suggests a phishing attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7414

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/strik?utm_term=the+perfect+pistol+shot PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4406223/normal_5f95801ee8f19.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368224/normal_5f9a99c8c1b8d.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4d8adb5c-17cf-4a6e-ac58-939bf37dc0c9/45889589520.pdfIn PDF document text
    • https://s3.amazonaws.com/buxoparadazegu/galliano_elementary_school_home_page.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e79ce4b-5d1f-42a4-807e-fc6c30082d0b/24_hour_fitness_northgate_trainers.pdfIn PDF document text
    • https://s3.amazonaws.com/tubupejevomo/string_adapter_recyclerview_android.pdfIn PDF document text
    • https://s3.amazonaws.com/tikoweravisixu/24695406221.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c7baa86-ae0b-4238-97b8-d07fee059184/1363528802.pdfIn PDF document text
    • https://s3.amazonaws.com/lemefofutomapox/sozopenudotikumifonaj.pdfIn PDF document text
    • https://s3.amazonaws.com/nopomewegobij/legexawalebi.pdfIn PDF document text
    • https://s3.amazonaws.com/henghuili-files/rosibesemosuv.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.