PDF malware analysis — malicious · 27c72cc7f3e4abe9

MALICIOUS

PDF

100.6 KB Created: 2021-02-06 18:40:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05

MD5: 3f22c42561388b21eb73d31f5b062fa2 SHA-1: 7436f0b1515957d5ef36d8483af36422edf0ad27 SHA-256: 27c72cc7f3e4abe9d473b5505709a07c8023d031e9aec9c50a20ddcc4178d560

64 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The file is a PDF document identified as malicious by ClamAV. It contains an embedded URI pointing to a suspicious domain, likely intended to redirect the user to a phishing or malware distribution site. No scripts were extracted, but the presence of the embedded URI strongly suggests a phishing or credential harvesting attempt.

Machine Learning

Nyx PDF Classifier clean score 0.1751

Heuristics 3

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://seumenha.ru/aws?utm_term=transformers+robots+in+disguise+2015+autobots PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.