PDF static analysis report

Static analysis result for SHA-256 4d2a466822feda68…

SUSPICIOUS

PDF

213.4 KB Created: 2017-09-28 13:33:47 -04:00 Authoring application: Microsoft® Word 2016 (via Neevia Document Converter Pro v6.9 (http://neevia.com)) First seen: 2026-05-04
MD5: a26a780111b87e41da1584cc087cea54 SHA-1: a078ecca464d9764975d6fe2577f3ffa544f22f3 SHA-256: 4d2a466822feda684da9a79b37f7949446c56d139ad8d1b3258bfb4e47aec15e
34 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains an embedded URI pointing to a suspicious domain, which is a common tactic for phishing or malware delivery. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample, limiting the ability to determine the exact payload or further actions.

Machine Learning

  • Nyx PDF Classifier malicious score 0.5402

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blackwaterdiv.info/yrn/yrn/index.php PDF link annotation
    • http://neevia.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://www.microsoft.com/typography/ctfontshttp://fontfabrik.comYouIn PDF document text
    • http://www.microsoft.com/typography/fonts/default.aspxIn PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0XIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0ZIn PDF document text
    • http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0In PDF document text
    • http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0TIn PDF document text
    • http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0In PDF document text
    • http://www.microsoft.com/Typography/0In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00006f6d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x6F6D 190852 bytes
SHA-256: 807c175c2b4e16f8ef38d13f67dbf4e98fa6f389f6b8108255afde3240b9f7c3
stream_002_off0001d155.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D155 199072 bytes
SHA-256: f8f3cd28e2fbfdcfc4faa800883a0f7acd858a6ddf5397e8b6e571e1ee473ed3

Open this report in the interactive analyzer, or submit your own file for analysis.