196.251.86[.]145IP address

“… file extracts the content of document.pdf (Python environment) using document.docx (7zip.exe), an encoded base64 is downloaded from 196.251.86[.]145, containing the Python script that serves as a shellcode loader.”