Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6ab62a5e7ef36a1…

MALICIOUS

PDF

59.7 KB Created: 2021-02-26 21:40:48 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2026-06-05
MD5: dcd0458c58fe38ca84d9bb3c276a96f3 SHA-1: f7c7f832fb0725f1da542ae75712f14c147c1810 SHA-256: f6ab62a5e7ef36a13cbd722316f5abf571f41fe54e2c5e5bce3dc2b8cf4783ba
94 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or malware distribution. ClamAV detection and ML classification confirm its malicious nature. The document body, though heavily obfuscated, appears to be a lure related to a search query, suggesting a phishing or social engineering attack vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6079

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kuzutuzo.ru/strik?utm_term=how+many+calories+in+cheesy+gordita+crunch PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4423136/normal_5fdeaebc42754.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404520/normal_600c3b00daac8.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367302/normal_60049a0294963.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444647/normal_5ffab3d67c0f6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4486765/normal_602495ad82934.pdfIn PDF document text
    • https://cdn.sqhk.co/lixipadiwel/hehingc/95332201935.pdfIn PDF document text
    • https://cdn.sqhk.co/nalujujoso/fibJggi/knock_down_the_house_review_rotten_tomatoes.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4493597/normal_5fdc04c67d1c4.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4426090/normal_5fe709d0a806d.pdfIn PDF document text
    • https://cdn.sqhk.co/lajawawinu/GpjfSic/draw_me_nearer_blessed_lord.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488837/normal_5fdc34b270674.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4424981/normal_5fc7e58f4bc75.pdfIn PDF document text
    • https://cdn.sqhk.co/nuvexajamu/hiE9ziR/free_slot_machine_games_for_fun_play.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422134/normal_6014ac4522a73.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4371010/normal_5ff7ada86cf21.pdfIn PDF document text
    • http://bikejesoxatelo.mygamesonline.org/febetabinerezubomasanolin.pdfIn PDF document text
    • http://fovikoxesaweziz.medianewsonline.com/mimuriroveb.pdfIn PDF document text
    • http://kikababono.mywebcommunity.org/74468663009.pdfIn PDF document text
    • https://s3.amazonaws.com/ritoma/calendario_2020_con_numero_de_semanas.pdfIn PDF document text
    • https://s3.amazonaws.com/farowug/guragelavupu.pdfIn PDF document text
    • https://s3.amazonaws.com/veraxawewib/cutting_compressed_fibre_cement_sheet.pdfIn PDF document text
    • https://s3.amazonaws.com/fadadedezeker/vopidoza.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.