PDF static analysis report

Static analysis result for SHA-256 0567137c72c2289e…

CLEAN

PDF

5.28 MB First seen: 2026-05-08
MD5: 44ea27c87a86a91c00ecedb8db31a92c SHA-1: a5d8e6f36e520a05bc7e12fdefd8c3d7b78b2c1c SHA-256: 0567137c72c2289e6f7d75ab238f31373983f3667d99b3ef8cef9d159abdff82
24 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is heavily obfuscated and encrypted, preventing direct content analysis. Heuristics indicate it uses an image-only lure and prompts the user for a password to open an archive, a common tactic to bypass gateway scanning. The presence of embedded JavaScript and a high stream count further suggest malicious intent, likely to download and execute a secondary payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.1511

Heuristics 3

  • Unusually high stream count medium PDF_MANY_STREAMS
    PDF contains 501+ stream objects — may indicate heap spray or heavy obfuscation
  • Encrypted PDF (string and stream contents are opaque to static scan) info PDF_ENCRYPTED
    PDF declares /Encrypt — string objects and stream contents are encrypted with the standard security handler (RC4 or AES). On its own this is informational; legitimate encrypted documents include signed contracts, billing statements, and rights-managed material. Static heuristics cannot inspect encrypted payload bytes.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.organized-crime.de/kvlInterdiscDimStudyOC-TOC-9-3-2006.pdf In PDF document text
    • http://www.organized-crime.de/puben01.htmlIn PDF document text
    • http://www.rcmp-grc.gc.ca/organizedcrime/octa_e.htmIn PDF document text
    • http://www.criminologia.net/pdf/reic/ano7-2009/a72009art9.pdfIn PDF document text
    • http://www.defensa.gob.es/ceseden/Galerias/destacados/publicaciones/docSegyDef/ficheros/048_LA_In PDF document text
    • http://www.interior.gob.es/file/11/11187/11187.pdfIn PDF document text
    • http://www.minetur.gob.es/industria/anpaq/convencion/documents/convdrog.pdfIn PDF document text
    • http://ceesg.org/files/formacion/legais-lexislacion-In PDF document text
    • http://www.jaimevegas.es/cms/downloads/1997_Detencion%20y%20apertura%20de%20paquetes%20In PDF document text
    • http://www.organized-crime.de/kvlInterdiscDimStudyOC-TOC-9-3-In PDF document text
    • http://www.mjusticia.gob.es/cs/Satellite/1292338970192?blobheader=application%2Fpdf&blobheaderIn PDF document text
    • http://www.iustel.com/v2/revistas/detalle_revista.asp?id_noticia=409675&d=1In PDF document text
    • http://www.abogacia.es/wp-In PDF document text
    • http://penal.blogs.lexnova.es/2014/08/28/algunas-cuestiones-In PDF document text
    • http://penal.blogs.lexnova.es/2014/08/28/algunas-In PDF document text
    • http://www.sandrocalvani.it/docs/20080920_Speeches_060810.pdfIn PDF document text
    • http://www.cni.es/es/queescni/ciclo/In PDF document text
    • http://www.elprofesionaldelainformacion.com/contenidos/2002/julio/11.pdfIn PDF document text
    • http://www.cni.es/comun/recursos/descargas/ev_113.pdfIn PDF document text
    • http://www.intelpage.info/fuentes-de-inteligencia.htmlIn PDF document text
    • http://www.elprofesionaldelainformacion.com/contenidos/2003/julio/3.pdfIn PDF document text
    • http://eco.mdp.edu.ar/cendocu/repositorio/01052.pdfIn PDF document text
    • http://www.serviciosdeinteligencia.es/es/revista/numero-8/In PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.unodc.org/documents/data-and-In PDF document text
    • http://www.ivac.ehu.es/p278-In PDF document text
    • http://www.raco.cat/index.php/RCSP/article/view/264676/352326In PDF document text
    • http://ccj.sagepub.com/cgi/content/abstract/24/3/263In PDF document text
    • https://www.europol.europa.eu/faq#n77In PDF document text
    • https://www.europol.europa.eu/sites/default/files/publications/es_euorganisedcrimesitrep04-In PDF document text
    • https://www.ncjrs.gov/pdffiles1/nij/grants/199047.pdfIn PDF document text
    • http://www.unodc.org/documents/treaties/UNTOC/Publications/TOC%20Convention/TOCebook-In PDF document text
    • http://www.unodc.org/documents/treaties/UNTOC/Publications/TOC%20Convention/TOCebook-s.pdfIn PDF document text
    • http://www.boe.es/doue/2008/300/L00042-In PDF document text
    • http://www.boe.es/boe/dias/1998/09/28/pdfs/A32349-32366.pdfIn PDF document text
    • https://www.guardiacivil.es/es/institucional/historiaguacivil/index.htmlIn PDF document text
    • https://www.guardiacivil.es/es/institucional/historiaguacivil/La_Fundacion.htmlIn PDF document text
    • https://www.unodc.org/documents/data-and-analysis/tocta/Globalization_of_Crime-ExSum-In PDF document text
    • https://www.unodc.org/pdf/convention_1988_es.pdfIn PDF document text
    • http://www.unodc.org/documents/organized-In PDF document text
    • https://wcd.coe.int/ViewDoc.jsp?Ref=Rec(2005)9&Language=lanEnglish&Ver=original&Site=COE&BackCIn PDF document text
    • https://wcd.coe.int/ViewDoc.jsp?Ref=Rec(2005)10&Language=lanEnglish&Site=COE&BackColorInternetIn PDF document text
    • http://dialnet.unirioja.es.are.uab.cat/servlet/articulo?codigo=3004311In PDF document text
    • http://dialnet.unirioja.es/servlet/articulo?codigo=75834In PDF document text
    • http://dialnet.unirioja.es/servlet/articulo?codigo=579093In PDF document text
    • http://criminet.ugr.es/recpc/15/recpc15-11.pdfIn PDF document text
    • http://dialnet.unirioja.es/servlet/articulo?codigo=75684In PDF document text
    • http://bddoc.csic.es:8080/detalles.html?id=310474&bd=JURIDOC&tabla=docuIn PDF document text
    • http://www.fcjs.urjc.es/procesal/revis.htmIn PDF document text
    • http://dialnet.unirioja.es/servlet/articulo?codigo=568849In PDF document text
    +49 more URL(s)

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 6

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_200_off0064a4e7.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x64A4E7 214980 bytes
SHA-256: 64d1b1a956533bb99a480bbacd99c29b317e073f1e7e6fb86efd4acb28b7b7d0
stream_203_off00693aab.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x693AAB 229020 bytes
SHA-256: 40ae5314ab15a2afb0127e286a82566f0f3bdfae18d8960dae1fbdf2a2c87056
font_01_sfnt_off006ae9db.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6AE9DB 56804 bytes
SHA-256: 15edbd3d172a16892dd83b7e90da0fd4fe04b430044012f42794d2fcdfd59297
font_02_sfnt_off006b4d85.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B4D85 185144 bytes
SHA-256: df0c7abd74b32026b48721bd4333cb449e45dd691824b6ae909084ddb313c0e5
font_03_sfnt_off006e2722.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E2722 82232 bytes
SHA-256: 878f8c9f5d968e09d8a2c7813a911cfcb0c86dcce7997adf0d035c9c2d9dd705
font_04_sfnt_off006e5497.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E5497 137736 bytes
SHA-256: 606e0622f4a0eb0a28c2e31eb0302ae4079764ceccd32abcd70b73372ef9a2e5

Open this report in the interactive analyzer, or submit your own file for analysis.