PDF static analysis report

Static analysis result for SHA-256 30d55a2228d7c008…

SUSPICIOUS

PDF

774.2 KB First seen: 2026-05-08
MD5: 3aa9e2ec16bf39f87ed12bd7c50fede0 SHA-1: fd650811026d910a1c66befd0e3c32f0e6f82110 SHA-256: 30d55a2228d7c008a22ff346d34dda186e88493e3d2b69f467752c7b54fcf3a7
50 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a hidden external HTML iframe, which is a common technique for redirecting users to malicious websites. The heuristic 'PDF_HIDDEN_HTML_IFRAME' strongly suggests this behavior. While most embedded URLs are benign, one unknown URL was found. The document body was unreadable, and no scripts were extracted, limiting further analysis of the exact payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0016

Heuristics 3

  • PDF contains hidden external HTML iframe high PDF_HIDDEN_HTML_IFRAME
    PDF bytes contain a hidden zero-size HTML iframe pointing to an external HTTP(S) URL. This is a strong malicious dropper/redirect indicator and is not expected in ordinary PDF content.
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.ereading.cz/mamu.htm In PDF document text
    • http://www.monotype.comMonotypeIn PDF document text
    • http://ocsp.verisign.com0In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/iX/1.0/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceEvent#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ManifestItem#In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xmp/InDesign/privateIn PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/swf/1.0/In PDF document text
    • http://www.w3.org/1999/xhtmlIn PDF document text
    • http://www.xfa.org/schema/xfa-data/1.0/In PDF document text
    • https://www.verisign.com/rpaIn PDF document text
    • http://ocsp.verisign.com/ocsp/status0In PDF document text
    • https://www.verisign.com/rpa0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl0In PDF document text
    • http://www.microsoft.com/typographyIn PDF document text
    • http://www.monotype.com/html/mtname/ms_arial.htmlhttp://www.monotype.com/html/mtname/ms_welcome.htmlhttp://www.monotype.com/html/type/license.htmlIn PDF document text
    • http://crl.verisign.com/tss-ca.crl0In PDF document text
    • http://crl.verisign.com/ThawteTimestampingCA.crl0In PDF document text
    • http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0DIn PDF document text
    • http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0In PDF document text
    • http://www.adobe.com/type/http://www.adobe.com/type/legal.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off00022d22.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x22D22 6924 bytes
SHA-256: 21cf8ecb003243fb7216f8807b61d6a7f4284463fdb5ebe05e968c5b0f68f021
stream_052_off00033abc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x33ABC 367087 bytes
SHA-256: b8e2518b116c26bab0e9f8c1672daf405dedad561157502b657e9005be2029aa
stream_057_off000691f5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x691F5 197120 bytes
SHA-256: 036d71e7b30400b329b1261c38bb640dd095bb60fb9b21e1dbc85e3430406e49
stream_082_off00092d56.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x92D56 231294 bytes
SHA-256: 4e4d9647d2cccb4de06922b6f45465ff33fcd08b9e8677824cf2c9dc28b2a63f
font_00_cff_off000854cd.bin pdf-font-stream PDF embedded font (cff) at offset 0x854CD 1330 bytes
SHA-256: 3dc1fb6c4dafd55161b23c000b23e93fb3153283c08cf40e241d84418606f21c
font_01_cff_off00085b13.bin pdf-font-stream PDF embedded font (cff) at offset 0x85B13 2444 bytes
SHA-256: e47f9f7319654f2be1e2cb479f3a4284cbc9af79988a370511f5fc367e9750db
font_02_cff_off000863dd.bin pdf-font-stream PDF embedded font (cff) at offset 0x863DD 4393 bytes
SHA-256: 11e92e0928a33e89d320bd84642603ecfd4c97f033a5d85540eaeb708208f937
font_03_cff_off00087274.bin pdf-font-stream PDF embedded font (cff) at offset 0x87274 2236 bytes
SHA-256: 1009b5aaac7bc0138c55af6b2bbce4916b2dc9c7c3fcb6da8f229bece395c587
font_04_cff_off00087c5c.bin pdf-font-stream PDF embedded font (cff) at offset 0x87C5C 3374 bytes
SHA-256: 52fbf5b8ea3cb35553b67fe455f74aad344f74abf57fa4b4ca34cd3c307dbac4
font_05_cff_off00088805.bin pdf-font-stream PDF embedded font (cff) at offset 0x88805 678 bytes
SHA-256: 6f292f0f52d829f6b331c50631838db5e28d3414359969fdf4fb8b13125cfca6

Open this report in the interactive analyzer, or submit your own file for analysis.