PDF static analysis report

Static analysis result for SHA-256 1d54fc1e2188c2f5…

SUSPICIOUS

PDF

85.0 KB Created: 2015-11-12 06:12:40 UTC Authoring application: RAD PDF (via RAD PDF 2.37.1.0 - http://www.radpdf.com) First seen: 2026-05-04
MD5: 336a8fb8d2c87dd12bfbed673a453590 SHA-1: 7f9ea658cbf0775a79dd37a983c015a390426c4c SHA-256: 1d54fc1e2188c2f5bff1e49005b49b4ce16d8ce3f89b53b4c999129c21b7fdac
32 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains embedded JavaScript and external URIs, indicating a potential for malicious activity. The document body explicitly contains URLs that appear to be related to payment processing, suggesting a phishing or scam attempt. The embedded JavaScript is likely used to facilitate the redirection to these malicious URLs.

Machine Learning

  • Nyx PDF Classifier clean score 0.0726

Heuristics 4

  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://delononline.com/payment/sveiw.htm PDF link annotation
    • https://originalredes.com.br/wp/wp-includes/css/js/DHIn PDF document text
    • http://disfracesjosmen.es/themes/info/DH/In PDF document text
    • http://www.radpdf.comIn PDF document text
    • http://www.radpdf.com)/Creator(RADIn PDF document text
    • http://www.dynaforms.comIn PDF document text
    • http://ow.ly/pBua305SDxQIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CSPCA.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/CSPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/tspca.crl0HIn PDF document text
    • http://www.microsoft.com/pki/certs/tspca.crt0In PDF document text
    • http://www.microsoft.com/typography/0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000c60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC60 46040 bytes
SHA-256: 8196ed5fd0683f580f55e3a2ca8a1e5fa6ccce7755683e506cb414e11463e149

Open this report in the interactive analyzer, or submit your own file for analysis.