Malicious PDF — malware analysis report

Static analysis result for SHA-256 08b5a7ab6760183f…

MALICIOUS

PDF

12.04 MB Authoring application: Skia/PDF m149 Google Docs Renderer First seen: 2026-05-07
MD5: 750758c96f77d8de64eca88569afb704 SHA-1: 2cb9da14de1bed6a96c226bfdfed00608edf2647 SHA-256: 08b5a7ab6760183f7719862aba120ece286e4380cdacb73ed87dc8cd244ce521
518 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9968

Heuristics 13

  • Adobe Reader Launch action command execution critical CVE exact CVE_2010_1240
    PDF uses the Adobe Reader/Acrobat Launch action pattern associated with CVE-2010-1240: cmd.exe is invoked with attacker-controlled parameters, paired with an embedded/exported payload.
  • ClamAV: Pdf.Tool.Agent-1388586 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Tool.Agent-1388586
  • Launch action critical PDF_LAUNCH
    PDF contains a /Launch action whose target is an executable, URL, or UNC path — can start an external application
  • /Launch action target: cmd.exe critical PDF_LAUNCH_COMMAND
    PDF /Launch action specifies an executable target with parameters '/Q /C %HOMEDRIVE%&cd %HOMEPATH%&(if exist "Desktop\\A complete Tetris 99 guide From beginner to expert.pdf" (cd "Desktop"' — references a known-dangerous executable (cmd, PowerShell, etc.).
  • Embedded attachment masquerades: declared document, content is windows-executable critical PDF_EMBEDDED_FILESPEC_CONTENT_MISMATCH
    An /EmbeddedFile attachment's declared filename extension or /Subtype MIME type contradicts the magic bytes of its decompressed content. The attachment is declared as a benign document or image but the bytes are an executable or executable-bearing archive. This is a deliberate deception used to hide droppers in PDF attachments and is a generic indicator of embed-and-drop weaponisation, independent of any specific CVE.
  • /Launch action paired with attachment-dropping JS API high PDF_LAUNCH_PLUS_DROPPER_JS
    PDF combines a /Launch action with a JavaScript API call that writes or opens an attached/external resource — the canonical shape of the CVE-2010-1240 /Launch + exportDataObject family. Benign PDFs do not pair these surfaces; the combination indicates a drop-and-execute chain regardless of the specific JS API knobs or /Launch target.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://harddrop.com/wiki/T-Spin_Mini_Double In PDF document text
    • https://harddrop.com/wiki/STSDIn PDF document text
    • https://harddrop.com/wiki/Imperial_CrossIn PDF document text
    • https://harddrop.com/wiki/C-SpinIn PDF document text
    • https://harddrop.com/wiki/TKI_3_OpeningIn PDF document text
    • https://harddrop.com/wiki/DT-CannonIn PDF document text
    • https://harddrop.com/wiki/AlbatrossIn PDF document text
    • https://harddrop.com/wiki/Perfect_Clear_OpenerIn PDF document text
    • https://harddrop.com/wiki/King_CrimsonIn PDF document text
    • https://harddrop.com/wiki/Infinite_TSTIn PDF document text
    • https://harddrop.com/wiki/Polymer_T-SpinsIn PDF document text
    • https://harddrop.com/wiki/BT_CannonIn PDF document text
    • https://harddrop.com/wiki/HachispinIn PDF document text
    • http://www.zeustech.net/In extracted file (A_complete_Tetris_99_guide_From_beginner_to_expert.pdf)
    • http://]hostname[:port]/pathIn extracted file (A_complete_Tetris_99_guide_From_beginner_to_expert.pdf)
    • https://discord.gg/qCyxgpKPDF link annotation
    • https://www.youtube.com/channel/UCVx7kmzyY3z5T_jAgbDW-FwIn PDF document text
    • https://www.youtube.com/channel/UCtN63NgulXsTAc-tPsJOAyAIn PDF document text
    • https://www.twitch.tv/tetriumIn PDF document text
    • https://www.twitch.tv/lookitsduckyIn PDF document text
    • https://www.youtube.com/channel/UCHog7L3CzsDg2GH9aza1bPgIn PDF document text
    • https://www.youtube.com/watch?v=DoLh5w5rwS0In PDF document text
    • https://twitter.com/melonpan_99/status/1398204059186696195In PDF document text
    • http://www.apache.org/In extracted file (A_complete_Tetris_99_guide_From_beginner_to_expert.pdf)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 18

Files carved from inside the sample during analysis.

FilenameKindSourceSize
A_complete_Tetris_99_guide_From_beginner_to_expert.pdf pdf-embedded-file PDF EmbeddedFile object 776 at offset 0xBFFB51 73802 bytes
SHA-256: 333bbc9b865cee1407f490005301cd098de44c393f4f0a6df025e4ed5debfce6
Detection
ClamAV: Win.Trojan.MSShellcode-6360728-0
Obfuscation or payload: likely
actual_type=PE; declared_or_context_type=PDF; filename=A_complete_Tetris_99_guide_From_beginner_to_expert.pdf; kind=pdf-embedded-file Static shellcode analysis found candidate code region(s). Indicators: SC_PEB_ACCESS, SC_STR_GETPROCADDRESS Static shellcode analysis recovered API/import strings: kernel32.dll, advapi32.dll, KERNEL32.DLL, ADVAPI32.DLL, LoadLibraryA, GetProcAddress
javascript_obj0777_000.js pdf-javascript-stream PDF /JS object 777 at offset 0xC0A801 99 bytes
SHA-256: 92f18c3b937916269f41d866990412c5b37e18685576b1c682d7fd7e36f8ac1d
Preview script
First 1,000 lines of the extracted script
this.exportDataObject({ cName: "A complete Tetris 99 guide From beginner to expert", nLaunch: 0 });
stream_001_off00000371.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x371 2764800 bytes
SHA-256: f6b88e76095216575cc6ce2cf100774dc32dc1add62ee838fbe74c73896c3855
stream_003_off00124f04.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x124F04 4194304 bytes
SHA-256: dcc0c75ee63fcb33151b137030c9ea9ed2490c98734ed14289e62250c3148354
stream_004_off004e09a4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E09A4 188505 bytes
SHA-256: 0acedeba3f382d0a804ed54e00e58715bb2aaf13dfd6efdfb791759407eae5b1
stream_011_off0050f3bd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50F3BD 241695 bytes
SHA-256: 1766d09e4c4e8c3b8fe142a35fec1fa60468e0bd9eb1d0353f23f00370031b13
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.74, consistent with packed or encrypted content.
stream_016_off0054f652.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x54F652 904800 bytes
SHA-256: 12153a7260b2954d1feefa3a2da66610bd6a002aa8389939c532c824293b3870
stream_017_off005c13c0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5C13C0 4194304 bytes
SHA-256: d9684f547cecc2db07012628b01f149e14a429ef8ba88d589971d727524d1464
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x06
stream_018_off00842c1e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x842C1E 374220 bytes
SHA-256: fc5a70d7007d9c459590880c7aa51da5bc990fbe13761e4b4803e6f97cf429cc
stream_022_off008ab6e8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8AB6E8 109368 bytes
SHA-256: fa7e4a5f2468cf172e41315ddef78c61a47527580e242b0cef4e2f41a74c869d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact entropy is 7.44, consistent with packed or encrypted content.
stream_023_off008c1500.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8C1500 323730 bytes
SHA-256: 96ca1714372b5f2e85b5eedd46d66bc421e7438004c232f857ad5e32bff9216d
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: heap spray 0x06
stream_025_off008cb4db.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8CB4DB 1619940 bytes
SHA-256: 71450b3aaba0d51dec14ccf771b3d087ad5a46d2d5db1fa62827a55b961dcf3e
stream_027_off00bed40d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xBED40D 52788 bytes
SHA-256: 3e63cf5ff11add665a3b6f8fa76a74a03120a842518fc87771ad1bd83eb178a2
icc_00_off00000198.icc pdf-icc-profile PDF ICC profile at offset 0x198 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off00be6e5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBE6E5A 38956 bytes
SHA-256: e983d88c427b42a02953e5b2cdb34a453c790ba8e8fde220697f411881ee2b74
font_02_sfnt_off00bf55c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF55C3 14364 bytes
SHA-256: 24628368195d0a04e3d69c38ec9ec3d52d6a55647e787751ee07d1f3efae7e28
font_03_sfnt_off00bf7542.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBF7542 20372 bytes
SHA-256: 539e888d71b155e012f35aff35f49dfd468f3e452c4d3eda1bafc945ccba97a9
font_04_sfnt_off00bfa7fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xBFA7FA 221936 bytes
SHA-256: f34896f6285a36210b11bb603182222cf0b972f1aab787bf02dfcbf8f6f8c024

Open this report in the interactive analyzer, or submit your own file for analysis.