Malicious PDF — malware analysis report

Static analysis result for SHA-256 0386b578b2984ea6…

MALICIOUS

PDF

84.5 KB Created: 2026-05-25 15:30:05 Authoring application: Qt 5.5.1 First seen: 2026-06-01
MD5: 1c1cfcdb94936b5148dff0c8bd56f436 SHA-1: ff1ced76614c4305110c49f0c29ee490c73e606e SHA-256: 0386b578b2984ea604242a7607d24f9c567c694b64d3cd16efbab6929071dd46
82 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0019

Heuristics 3

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 84 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://hpen.org/logo/mny/#sales@zuendoptics.com In PDF document text
    • http://www.microsoft.com/typography/fonts/In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
    • http://www.microsoft.com/typography/fonts/MicrosoftIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c1d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC1D3 14148 bytes
SHA-256: e11983312ee7006eaa67e772e2768af493f226ab8838f0e6ab6e9621018c7018
font_01_sfnt_off0000de14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE14 2852 bytes
SHA-256: 3e78e00330bea0a47609fc68df43a5e00c545a7db4fadf4bbe1b642e69c7643b
font_02_sfnt_off0000e7c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE7C8 5584 bytes
SHA-256: 0a37c73b327df12c9cf7473c2b9cb59eba811db33e0e70ea869323c7428bea4a
font_03_sfnt_off0000f45b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF45B 4508 bytes
SHA-256: 3c64e38b25bef1eb68c3abe3376e0014db3ce893f184456aaf9c12af98341e2e
font_04_sfnt_off00010120.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10120 13024 bytes
SHA-256: 1870008728c36d281512dd8c6f773ddf82af516c39c5ca10eaceadfdc7b52a19
font_05_sfnt_off000117c7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x117C7 16720 bytes
SHA-256: 41502691e02ca9cd1c2be8c4af16b0ac501ad32e3de695c77e600f7f5800012f
font_06_sfnt_off00013533.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13533 4692 bytes
SHA-256: 75c2aa7046c0f4800a112f31ef781604af3888df10d539f6001b40155e20c5cf

Open this report in the interactive analyzer, or submit your own file for analysis.