Malicious PDF — malware analysis report

Static analysis result for SHA-256 c823ea2fb519d581…

MALICIOUS

PDF

58.6 KB Created: 2021-02-23 10:45:42 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: f45503ec17837bc908c3c245cef231b9 SHA-1: 30840c02cc8861150d2b6011d7e6bcbe976aff66 SHA-256: c823ea2fb519d58123ad14da5ca22f3325f32ce3363dec7202e214b25378268f
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a URL that mimics a search query, likely intended to trick the user into visiting a malicious site for phishing or malware delivery. ClamAV and ML heuristics also flagged this PDF as malicious, specifically identifying it as a phishing trojan. No scripts were extracted, but the embedded URI is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7810

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bologen.ru/strik?utm_term=how+to+set+onn+clock+radio PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4492892/normal_600ce2a62b9e3.pdfIn PDF document text
    • https://cdn.sqhk.co/xawodoze/ib4eig7/59428822223.pdfIn PDF document text
    • https://cdn.sqhk.co/dodirorip/gNcjdpC/logukawamukokugasurenu.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4401518/normal_5ffeffb457581.pdfIn PDF document text
    • https://cdn.sqhk.co/keviwebewuta/cJhaji2/wexerowaperejigoretefuba.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4445532/normal_5ff12a5b32c84.pdfIn PDF document text
    • http://fibakigefejep.66ghz.com/catia_v6_installation_guide.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4489722/normal_6001fe88d4845.pdfIn PDF document text
    • http://sdfafq.info/tchibo_cafissimo_compact_manual_englishsgvnw.pdfIn PDF document text
    • http://universityru.fun/13182858426kebqq.pdfIn PDF document text
    • http://bullbananavannaone.xyz/adobe_colour_ccfa76f.pdfIn PDF document text
    • https://cdn.sqhk.co/jivomawufem/cie7Did/96966057139.pdfIn PDF document text
    • https://s3.amazonaws.com/xijalovelokolep/4001791753.pdfIn PDF document text
    • https://s3.amazonaws.com/dotivaf/burox.pdfIn PDF document text
    • https://s3.amazonaws.com/vonusirukete/pumejitumufufowosajifiw.pdfIn PDF document text
    • https://s3.amazonaws.com/jivala/78758438380.pdfIn PDF document text
    • https://s3.amazonaws.com/lanorolowu/botiba.pdfIn PDF document text
    • http://lepevalir.rf.gd/81005358859.pdfIn PDF document text
    • http://rajowezurub.rf.gd/how_to_become_a_certified_personal_trainer_for_free.pdfIn PDF document text
    • https://s3.amazonaws.com/jupIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.