Malicious PDF — malware analysis report

Static analysis result for SHA-256 550f087fbc5fdf0a…

MALICIOUS

PDF

121.8 KB Created: 2017-01-27 10:29:28 +01:00 Authoring application: RAD PDF (via RAD PDF 2.38.3.1 - http://www.radpdf.com) First seen: 2026-05-04
MD5: f6a3ad7239ff811748958459cb0e147a SHA-1: f4c35d02ea3848710de39a381bebdb6fa93b6e35 SHA-256: 550f087fbc5fdf0aa5b2b78c3bda00e3f37ae5de1e289d33fe1234417d1be777
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple invisible and repeated links pointing to Dropbox URLs, which are designed to trick the user into downloading a ZIP archive. This archive likely contains an executable payload, as indicated by the 'SwiftMessage.exe' filename and the ClamAV detection of 'Pdf.Dropper.Agent'. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8491

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-7212985-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7212985-0
  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://www.dropbox.com/s/q2pxyat76300fhz/BANK%20DRAFT%20COPY1.zip?dl=1 In PDF document text
    • https://www.dropbox.com/s/2upqdnjeozomqs0/SwiftMessage.exe?dl=1In PDF document text
    • https://www.dropbox.com/s/agumqywj9ena1ks/PAYMENT%20ADVICE%20REF.zip?dl=1In PDF document text
    • http://www.radpdf.comIn PDF document text
    • http://www.radpdf.com)/Creator(RADIn PDF document text
    • http://www.dynaforms.comIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text
🗂 Part of campaign: shared payload 211db2fe9b 3 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000006c8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C8 98205 bytes
SHA-256: 211db2fe9b00da0769dc17e36faecacd3316fd1da82722127767ca9a55753e64

Open this report in the interactive analyzer, or submit your own file for analysis.