Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c5052794ae01826…

MALICIOUS

PDF

55.8 KB Created: 2021-03-02 01:42:07 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: c922c4ea8b8e76e083daa7008e467ac0 SHA-1: 3b764676e8be98766768b5267fa945a96d76b403 SHA-256: 9c5052794ae01826bffd4cc07216d2ba5462df39c351cdfe1eed539fc47df24a
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The file is a PDF document that contains a URL pointing to a phishing domain. Heuristics indicate the presence of external URIs and a machine learning classifier flagged the PDF as malicious. ClamAV also detected it as a phishing trojan. The document body, though heavily obfuscated, suggests a lure related to an award, likely intended to trick the user into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6664

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=harmony+high+back+booster+car+seat PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4483604/normal_5fe9e18c9caba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4411935/normal_603d70d5dfd1d.pdfIn PDF document text
    • http://kamini33.ru/strucid_hack_scriptpv2n8.pdfIn PDF document text
    • http://creditscoretracking.info/41514123483u94sp.pdfIn PDF document text
    • http://natur-bio.space/bipuvekubdceyl.pdfIn PDF document text
    • http://cashtanks.fun/arcade_game_room_mod_apkxqnzj.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4506131/normal_5fdb7c00cab08.pdfIn PDF document text
    • https://s3.amazonaws.com/pukaridimupo/tamil_nadu_land_guideline_value_revision.pdfIn PDF document text
    • https://s3.amazonaws.com/jedobufudajewu/11699855829.pdfIn PDF document text
    • https://s3.amazonaws.com/jinotugiwomo/how_to_go_from_1_million_to_10_million.pdfIn PDF document text
    • https://s3.amazonaws.com/nimuwet/a_good_cover_letter_template.pdfIn PDF document text
    • https://s3.amazonaws.com/wiwuxot/princeton_review_gre_books_free.pdfIn PDF document text
    • https://s3.amazonaws.com/selivuvumepaveb/vs_code_format_on_save_not_working.pdfIn PDF document text
    • https://s3.amazonaws.com/zarelusipofox/christmas_carols_sheet_music_piano.pdfIn PDF document text
    • https://s3.amazonaws.com/mozirolinitaje/35446904872.pdfIn PDF document text
    • https://s3.amazonaws.com/lonozote/craftsman_3_gal._oil-lubricated_air_compressor_with_accessory_kit.pdfIn PDF document text
    • https://s3.amazonaws.com/vuforewebub/pedodapebirafez.pdfIn PDF document text
    • https://s3.amazonaws.com/dosalapasenow/vejusemewinorefafip.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.