Malicious PDF — malware analysis report

Static analysis result for SHA-256 97dcc2da5a27fbb5…

MALICIOUS

PDF

41.4 KB Created: 2020-11-18 12:34:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: bc006d07de6d7cbb2398f97117c12461 SHA-1: 680a813affd5019fecc023a88cd7ffc849e260ae SHA-256: 97dcc2da5a27fbb53565793f107c8f65495d181e9f7db017172a8e58501cad9c
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. No scripts were extracted, but the presence of the external URI suggests an attempt to redirect the user to a malicious site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6525

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafficel.ru/aws?utm_term=alpha+bravo+charlie+drama PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4408995/normal_5f9350549043b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4379613/normal_5f93e97cd1039.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4401712/normal_5fa89f60d772f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370071/normal_5f9006703890d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4373749/normal_5f88c9491a2d4.pdfIn PDF document text
    • https://mavegisokelu.weebly.com/uploads/1/3/4/1/134131346/9ee832c69139.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9df4a2f5-d786-4d21-8a75-3bd2f8b9177b/qumi_projector_q3_manual.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3b00993a-bf72-479e-a51f-e8e71c124084/xupebozirokenajugovofiwi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/49e09874-9176-4359-9291-06759dc9e462/rashkis_elementary_school_nc.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6ea11fb2-ed86-4efd-8377-5302f494f301/math_kangaroo_2011_questions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2727170f-836e-4b03-8e32-1065fe2c8f32/buenas_noches_poema_para_mi_novia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0c7eba90-9efb-4e0f-aa0a-3c77dcaecc2d/49265541841.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.