Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e3f938ab3b18793…

MALICIOUS

PDF

186.0 KB Created: 2016-06-21 09:20:13 UTC Authoring application: RAD PDF (via RAD PDF 2.38.3.1 - http://www.radpdf.com) First seen: 2026-05-04
MD5: 4b167136c7fe8c85001c18da5b201449 SHA-1: c43f36b07cc988ec93dddf104e7f20058ca90e35 SHA-256: 2e3f938ab3b18793f95d3591b478c5fb67b2f8f5d847fffd4927dc61f84f2d1b
220 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains embedded JavaScript and utilizes a URL shortener, indicating an attempt to obfuscate the delivery of malicious content. The heuristic 'PDF_CVE_2023_26369_RELATED' strongly suggests exploitation of a known PDF vulnerability. The embedded URLs point to potentially compromised websites hosting further stages of the attack. The ClamAV detection as 'Pdf.Dropper.Agent-7244581-0' confirms its malicious nature as a dropper.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6423

Heuristics 6

  • TrueType bitmap font + active content — CVE-2023-26369 related high CVE related PDF_CVE_2023_26369_RELATED
    PDF embeds a TrueType font with bitmap tables (EBDT/sbix/CBDT) alongside exploit delivery indicators — CVE-2023-26369 exploits the sfac_GetSbitBitmap function in Adobe's libCoolType for arbitrary code execution. This CVE was actively exploited in the wild, but this rule does not validate the malformed EBLC/EBDT primitive.
  • ClamAV: Pdf.Dropper.Agent-7244581-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7244581-0
  • PDF JavaScript exploit cluster critical PDF_JS_EXPLOIT_CLUSTER
    PDF combines an executable JavaScript/action surface with exploit staging indicators such as eval/unescape/fromCharCode, XFA script content, or a related CVE pattern. Benign form JavaScript remains low-severity, but this correlated cluster is high-confidence malicious behavior.
  • Clickable URI uses URL shortener medium PDF_URL_SHORTENER_URI
    PDF contains a clickable HTTP(S) action whose destination is a URL shortener. This hides the final landing page from static review and is common in phishing redirect PDFs.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mjsbuilders.com/wp-includes/js/jcrop/daum/ In PDF document text
    • http://ciamaaramados.com.br/druzzy/Order.pdf/Adobe%20File%20View.htmlIn PDF document text
    • http://ciamaaramados.com.br/aka/In PDF document text
    • https://penielghana.org/wp-admin/user/druzzy/pdf/pdf/jk/index.htmIn PDF document text
    • https://penielghana.org/wp-admin/user/Mancity/pdf/pdf/jk/index.htmIn PDF document text
    • http://www.radpdf.comIn PDF document text
    • http://www.radpdf.com)/Creator(RADIn PDF document text
    • http://www.dynaforms.comIn PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://ocsp.verisign.com01In PDF document text
    • http://www.monotypeimaging.com/In PDF document text
    • http://tinyurl.com/zjgbpllIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouReferenced by PDF JavaScript
    • http://www.microsoft.com/typography/fonts/default.aspxReferenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0Referenced by PDF JavaScript
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TReferenced by PDF JavaScript
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0Referenced by PDF JavaScript
    • http://www.microsoft.com/Typography/0Referenced by PDF JavaScript
    • http://www.microsoft.com/typography/ctfontshttpReferenced by PDF JavaScript
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • https://www.verisign.com/cps0*In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://logo.verisign.com/vslogo.gif0In PDF document text
    • http://crl.verisign.com/pca3.crl0In PDF document text
    • http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0DIn PDF document text
    • http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off000012a3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x12A3 247488 bytes
SHA-256: 823b2df26334b0b984f300dc0581d8ec81b39087db1a5f0c6c625f9acc1a43a4
stream_001_off00011c84.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x11C84 193824 bytes
SHA-256: b671e87d34e3a4891cd6295fe05fd78d853876dfae4cbbcbae599023d9f556fb

Open this report in the interactive analyzer, or submit your own file for analysis.