Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3d6232ae4b6ffac…

MALICIOUS

PDF

27.0 KB Created: 2021-05-30 09:36:32 UTC Authoring application: Softplicity First seen: 2026-07-02
MD5: 1de157afbe5e871b255e6cbc1a49c46a SHA-1: 8b6dc58a500e897494c6ccf9655ed320143f716a SHA-256: f3d6232ae4b6ffac64805b7389baff4991caadf66d2ff9767a9f826bbf1e4b0a
64 Risk Score

Machine Learning

  • Nyx PDF Classifier suspicious score 0.2934

Heuristics 3

  • Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
    Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://cdn-cms.f-static.net/uploads/5250325/normal_60afb87677988.pdf PDF link annotation
    • https://cdn-cms.f-static.netPDF link annotation
    • https://cdn-cms.f-static.net/uploads/5250638/normal_60afc033c547d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5250471/normal_60afbda1bcbb7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5250552/normal_60afbdc11157d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5250445/normal_60afbe653a942.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5250538/normal_60afba403f5d7.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5250325/normal_60afb5142d73c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b33f3f10e8b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b3404579395.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b34034bf72b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b3407582a56.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b340658adc2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b33e7abf75d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b33e293de2d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b340232841d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/5257221/normal_60b340558ceb0.pdfIn PDF document text
    • http://por.lods.icu/dls.php?q=Vw+Polo+Manual+2015In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
🗂 Part of campaign: f-static.net 38 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.