Malicious PDF — malware analysis report

Static analysis result for SHA-256 461da018264ab404…

MALICIOUS

PDF

2.15 MB Created: 2026-05-19 21:55:25 -03:00 Authoring application: D4Sign.com.br (via mPDF 8.0.7) First seen: 2026-05-20
MD5: 8ccc23b01a10a12d882cee10c20f5de1 SHA-1: 68fbadd2f7284eabccc487a9fa4707b95b6eb223 SHA-256: 461da018264ab40475c8e7a58ea4f0ab32986ca00ee0ba835ee27cba261564e3
106 Risk Score

🔏 Digital signature Signed

A signature covers the whole signed byte range — PDF JavaScript is never signed on its own — and does not by itself mean the document is safe.

Machine Learning

  • Nyx PDF Classifier clean score 0.0003

Heuristics 5

  • Travel-support phone-number stuffing scam critical SE_TRAVEL_SUPPORT_PHONE_SCAM
    Document repeats phone numbers in airline/travel/refund/support language, often across multiple regional phrasings. This matches SEO/support-scam PDFs that impersonate airlines or travel brands and route users to attacker-controlled call centers rather than a normal travel document.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://secure.d4sign.com.br/verificar In PDF document text
    • http://sac.seanet.com.brIn PDF document text
    • http://www.seanet.com.brIn PDF document text
    • http://dejavu.sourceforge.netFontsIn extracted file (font_01_sfnt_off0000a5c5.bin)
    • https://www.google.com.br/maps/search/-23.474023113347428PDF link annotation
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In PDF document text
    • http://dejavu.sourceforge.netIn extracted file (stream_030_off0000700f.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (stream_030_off0000700f.bin)
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseDejaVuIn extracted file (font_01_sfnt_off0000a5c5.bin)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 11

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_030_off0000700f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x700F 19856 bytes
SHA-256: 4cc0e1efedb57c43fcfdfd98b722f2dca7ede05376b4d3ad3e703f892b528350
stream_136_off0021913f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x21913F 21276 bytes
SHA-256: d6e3334b8c13a97327c37f6b7848a076a120e606f040fac8af4d78686f0f0af7
font_01_sfnt_off0000a5c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA5C5 26652 bytes
SHA-256: d0d9bce114432bbae9e47828020f61b774071b7ea71221d96b89e04d764e9920
font_02_sfnt_off0000ddfc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDFC 27604 bytes
SHA-256: c1c775f0b54973a64fc8d3ea692b07c800f889183e98ef8802c05d64e8d1b6af
font_03_sfnt_off0001168b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1168B 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_04_sfnt_off00206c0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x206C0F 20912 bytes
SHA-256: fa273c6c17fff539ea31b5efe70429c61b8209ac4761ada03e90fabb9045f2e8
font_05_sfnt_off0020a53d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20A53D 21728 bytes
SHA-256: d64a295e40fd19e94f31ca5fb96f7e0411b695b185be1f8d7be4f2367cff80a8
font_06_sfnt_off0020e18f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20E18F 27924 bytes
SHA-256: 8461584cc067d7e18b188f3ad7612ab7e5213da9a7370f8ec779d511eb68a565
font_07_sfnt_off00211cdb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x211CDB 28784 bytes
SHA-256: 20bb6a85efe7b5f739856918472b4cb012bef52de492004900efb615da879f1c
font_08_sfnt_off002159a3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2159A3 20868 bytes
SHA-256: 5484e4c47fda5ddbe61cf0ec39116264a924ff242714126ab68dd19db1128bd9
font_10_sfnt_off0021c94c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x21C94C 26564 bytes
SHA-256: a20b1606be44b0afedcb0e04ceed094cccc7684641047b0396ebc6d77ba4f325

Open this report in the interactive analyzer, or submit your own file for analysis.