PDF static analysis report

Static analysis result for SHA-256 0ce8e78a36badacc…

CLEAN

PDF

504.5 KB Created: 2015-04-13 04:14:40 Authoring application: Microsoft® Office Word 2007 First seen: 2026-05-08
MD5: 2ffb51f6c03f1c0feae4c905e5158dbd SHA-1: c11090b408824146c79d2e4018e539cb3b2deb7d SHA-256: 0ce8e78a36badaccd0bd25f6f160900417d90428a3574f1fb187db27dd7b197b
12 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The sample is a PDF file identified as suspicious due to the presence of active content and a heuristic match for CVE-2023-26369. This vulnerability allows for the execution of arbitrary code, indicating a likely attempt to download and run a secondary payload. The presence of an external URI pointing to an email address suggests a potential phishing or social engineering vector.

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 3

  • TrueType bitmap font + active content — CVE-2023-26369 related info CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • External URI low PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYou PDF link annotation
    • http://www.microsoft.com/typography/fonts/default.aspxPDF link annotation
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZPDF link annotation
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XPDF link annotation
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0PDF link annotation
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TPDF link annotation
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0PDF link annotation
    • http://www.microsoft.com/typographyPDF link annotation

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_012_off00018bd0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x18BD0 198448 bytes
SHA-256: 9b228c9200f00feaa1c18c75be9030721c492cfc84c098c19f2a397c08df257b

Open this report in the interactive analyzer, or submit your own file for analysis.