Malicious PDF — malware analysis report

Static analysis result for SHA-256 5250905718cd4e7a…

MALICIOUS

PDF

99.8 KB Created: 2026-06-10 10:40:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-10
MD5: 6c44dac4858712120434fa05ca45a99e SHA-1: 1ef6971eaf262384dfc63b3604886bc14e264794 SHA-256: 5250905718cd4e7a1506be103e0cbb67fabc7f7d76073bc5b0b51beddbb8a354
122 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0010

Heuristics 5

  • Image-only PDF lure links through URL shortener high PDF_IMAGE_LURE_SHORTENER_LINK
    PDF is image-heavy with little real text and its clickable action points to a URL shortener. This is a high-confidence credential-phishing carrier shape: the visible page is a screenshot-like prompt while the destination is hidden behind redirect infrastructure.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 2 image(s), only 0 text block(s), carries a click-outward action, and is only 99 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Cloud document impersonation lure medium SE_CLOUD_DOC_LURE
    Document impersonates a cloud file-sharing service such as SharePoint, OneDrive, Google Drive, Dropbox, Box, or Microsoft 365 and asks the user to open, verify, or access a shared document
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://tinyurl.com/5dy4wphh In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_000_off000001cc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1CC 315074 bytes
SHA-256: 247ce851d008abb71a4d42b4099f25ac8eb1c9d97e79bf6fdcf8425045de2281
font_00_sfnt_off00012f92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F92 15676 bytes
SHA-256: d2adfe2ca01cf04608da520dbd71cfe79a7ab0516edf53c0edbe3569d74c05e3
font_01_sfnt_off00014b96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14B96 14256 bytes
SHA-256: 61462ae18132282bf4da89c171a5cb86b7d52611d05ca124d6d0d494b0aab197
font_02_sfnt_off000162ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x162EC 17184 bytes
SHA-256: 02bdee5aaef18c47ee8d1049b0594af56f5d9cfa80ea5d4b83940a6d05acf062
font_03_sfnt_off000185e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x185E1 792 bytes
SHA-256: 56b712e630cfed1b9f4013a6458874cf9350000ffc6e12991770e1f4febddd11

Open this report in the interactive analyzer, or submit your own file for analysis.