Malicious PDF — malware analysis report

Static analysis result for SHA-256 5133afaab6d2cf33…

MALICIOUS

PDF

93.8 KB Created: 2026-06-04 20:39:57 +00:00 Authoring application: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36 (via Skia/PDF m143) First seen: 2026-06-05
MD5: c41e178b640b3a1b88ba368b2bfc828e SHA-1: 222280e731649cd145cd59167bbeebf6b4e6fb59 SHA-256: 5133afaab6d2cf33bfc13cab36723c924066c5715bc1baacdf674a10f43cd367
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0001

Heuristics 2

  • QR-code business verification phishing lure high PDF_QR_PHISHING_LURE
    PDF contains a QR-like image and visible text instructing the recipient to scan or use a QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. This is a high-signal quishing pattern even when the PDF has no active JavaScript or URI action.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
icc_00_off00000196.icc pdf-icc-profile PDF ICC profile at offset 0x196 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off00005f20.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F20 53480 bytes
SHA-256: 6f75b5dd238b025d8a71051579b14362713c119e3b4a7e3050993fdaa386329f
font_01_sfnt_off0000ed15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED15 33744 bytes
SHA-256: 92261fb77539bb47484e413abbdddda410805982a8db7943853f7d2b2549788e
font_02_sfnt_off000146fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x146FA 17012 bytes
SHA-256: 74d544edcf2ba2606680c355d0a5c8c2781ec37c0e686e5415350d7931249fc5

Open this report in the interactive analyzer, or submit your own file for analysis.