Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a045b3b006ae14a…

MALICIOUS

PDF

99.7 KB Created: 2026-05-28 17:59:00 +02:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-05-29
MD5: 89b6ac04f0ffb443a76330426a295f4e SHA-1: 57b88b1d129feb14264a53a401fbfcf21020da1e SHA-256: 0a045b3b006ae14ab6c1b7db4224b55a26df004a55b16313da9c37c8866bd4c3
122 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0010

Heuristics 5

  • Image-only PDF lure links through URL shortener high PDF_IMAGE_LURE_SHORTENER_LINK
    PDF is image-heavy with little real text and its clickable action points to a URL shortener. This is a high-confidence credential-phishing carrier shape: the visible page is a screenshot-like prompt while the destination is hidden behind redirect infrastructure.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 99 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tinyurl.com/2w7jscw6 In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off000001c8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1C8 315074 bytes
SHA-256: 247ce851d008abb71a4d42b4099f25ac8eb1c9d97e79bf6fdcf8425045de2281
font_00_sfnt_off00012f8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F8D 15676 bytes
SHA-256: d2adfe2ca01cf04608da520dbd71cfe79a7ab0516edf53c0edbe3569d74c05e3
font_01_sfnt_off00014b91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B91 14256 bytes
SHA-256: 61462ae18132282bf4da89c171a5cb86b7d52611d05ca124d6d0d494b0aab197
font_02_sfnt_off000162e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x162E7 17152 bytes
SHA-256: bca1b592ebe10ce0719371f2355d9c0da1a2b4cbacca74775e731abc89e661ed
font_03_sfnt_off000185a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x185A4 792 bytes
SHA-256: 56b712e630cfed1b9f4013a6458874cf9350000ffc6e12991770e1f4febddd11

Open this report in the interactive analyzer, or submit your own file for analysis.