Malicious PDF — malware analysis report

Static analysis result for SHA-256 267104681bb2212b…

MALICIOUS

PDF

13.0 KB First seen: 2026-05-11
MD5: acd227ba0f7cdb3893018141066cdcb7 SHA-1: 28b5d66611830d01e0ee39fb92642d220d90883e SHA-256: 267104681bb2212b1cc2c66d53ee3e54cb6bf07218e4838a010c0b428deac86a
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file was flagged as malicious by an ML classifier and contains an embedded SWF file named 'kpnc.swf'. This embedded Flash file is a strong indicator of an exploit or a downloader for a second-stage payload. The presence of a confirmed benign URL is likely a decoy or unrelated to the malicious functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9958

Heuristics 5

  • RichMedia (Flash) high PDF_RICHMEDIA
    PDF contains /RichMedia (Adobe Flash) which is a historic exploit vector
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PSSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adobe.com/AS3/2006/builtin In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
kpnc.swf pdf-embedded-file PDF EmbeddedFile object 16 at offset 0x427 11885 bytes
SHA-256: d649187d10bf6dee4a36e0b0a5af01520ac2dc24f43d0fc914f380472e9c3c82
Detection
ClamAV: No threats found
Obfuscation or payload: likely
actual_type=SWF; declared_or_context_type=PDF; filename=kpnc.swf; kind=pdf-embedded-file

Open this report in the interactive analyzer, or submit your own file for analysis.