Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d0c4a53c32b4fa6…

MALICIOUS

PDF

185.2 KB Created: 2019-12-15 02:18:28 +00:00 Authoring application: mPDF 8.0.0 First seen: 2026-05-30
MD5: 8a73243a73929be279612e88d0cc773c SHA-1: 0c223813c51485342b598d3b8b74f1390ef068d2 SHA-256: 0d0c4a53c32b4fa68c7c40563a8aa0a49a8fec37ac75127cad4f8b94f82bae4e
62 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • Secondary embedded PDF body has suspicious static findings critical POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.monotypeimaging.comhttp://www.monotypeimaging.com/ProductsServices/TypeDesignerShowcaseNOTIFICATION In PDF document text
    • http://www.monotypeimaging.com/html/license.aspxIn PDF document text
    • http://www.stixfonts.orgIn PDF document text
    • http://www.tiro.comIn PDF document text
    • http://www.stixfonts.org/user_license.htmlIn PDF document text
    • http://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d54.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D54 44744 bytes
SHA-256: 753242f70c79753d9afd82121aa678b9ef3b2ffc8410f5d9dff009c7bb677636
font_01_sfnt_off0000a5f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA5F5 26164 bytes
SHA-256: f47b0abb0e3e4801640dcc8114bbfbc4d5443f163b1ccca46883719a6b6301ee
font_02_sfnt_off0000ea61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEA61 21552 bytes
SHA-256: 86fe1baf0979446937f2d7b551db65231c6b605cfe265d9c5d61a655e6a209af
polyglot_child_pdf_off0000000f.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0xF 189593 bytes
SHA-256: cbad74476f6fcd353d3318d8b4c61d7917d55175a1c1a47d15015c72d6895565
polyglot_child_pdf_off0000001e.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x1E 189578 bytes
SHA-256: c9aa6459342085e010e532c1f5f96198c4ba88320919a7c8fe1a65a194b0ba7b

Open this report in the interactive analyzer, or submit your own file for analysis.