Malicious PDF — malware analysis report

Static analysis result for SHA-256 27f2b164cbb9d24a…

MALICIOUS

PDF

116.3 KB Created: 2008-08-05 23:16:47 UTC Authoring application: Apple Keynote 4.0.3 (via Mac OS X 10.5.4 Quartz PDFContext) First seen: 2026-05-11
MD5: ffd34f922e05d330de4aa02c34b92556 SHA-1: a06bdfd329f2db1595f4f876201a89ff5e2b2558 SHA-256: 27f2b164cbb9d24afef9e9fb5f760205c57c942e453d1983d1c6a430ec8c66fe
72 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1566.001 Spearphishing Attachment

The PDF file triggered a critical ClamAV heuristic indicating it is a known exploit (Pdf.Exploit.Agent-22991). The presence of embedded URLs, though benign in this case, and the PDF structure suggest an attempt to exploit a client execution vulnerability. The lack of specific document body text or scripts means the exact payload and delivery mechanism cannot be determined, but the exploit itself is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.0011

Heuristics 4

  • ClamAV: Pdf.Exploit.Agent-22991 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Exploit.Agent-22991
  • String.fromCharCode low PDF_FROMCHARCODE
    String.fromCharCode found — used to construct payload strings dynamically. Common in benign JavaScript libraries for codepoint manipulation, so this alone is informational; weaponised use is also caught by the dedicated fromCharCode-stage and exploit-shape rules. (matched inside decoded stream)
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.w3.org/1999/02/22-rdf-syntax-ns# In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00016b71.icc pdf-icc-profile PDF ICC profile at offset 0x16B71 1296 bytes
SHA-256: 94722fe267764797f8887379cc0d355f5118beb3d186e087bfbd9e1a3f2d3f49
icc_01_off00016e8f.icc pdf-icc-profile PDF ICC profile at offset 0x16E8F 1456 bytes
SHA-256: 2a18161bb96fd584d19e737ce294732789e0e8e6ae8c8e4e5f09f1b138232a63
font_00_sfnt_off0000c66b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC66B 39824 bytes
SHA-256: 8a5509aac6957551a4e67cbce90559f5ed38cbad6ed2a25cbd07a406d2bad6a9
font_01_sfnt_off00013b30.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B30 4216 bytes
SHA-256: 1cd589321f6c176bccad93177fe3bba6e3b1f175184f637489d68a082d30d515

Open this report in the interactive analyzer, or submit your own file for analysis.