Malicious PDF — malware analysis report

Static analysis result for SHA-256 7938955378705aaa…

MALICIOUS

PDF

92.3 KB First seen: 2026-06-11
MD5: e0502fd0fb32f2be6360940125723e98 SHA-1: 2824c0847676741f650b11feeb8104348a03b7ee SHA-256: 7938955378705aaa11c55bc5e935f050695af23c8d50f214f8e91bb1c03a2422
60 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0028

Heuristics 5

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • JavaScript action low 1 related finding PDF_JAVASCRIPT
    PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cgi.adobe.com/special/acrobat/update Referenced by PDF JavaScript

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_020_off00009b0e.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9B0E 902 bytes
SHA-256: e985b5df65c8c3cf732a9074b575fbc594c1c7f0bccc0994182ec7e5c0f7308a
stream_021_off00009c6e.js decompressed-pdf-stream PDF FlateDecoded stream at offset 0x9C6E 1363 bytes
SHA-256: 529357503ec67b623d2a12816cdeea62bd639f2b4ff4e568b01c96cc3f5bfc6f
objstm_0001_00.bin pdf-objstm-decoded PDF /ObjStm 1 0 obj (inflated) 27643 bytes
SHA-256: 04620fdcf2a293ec9bd4297561844bd7b24fa3eab7f7be6006efa69ae63a32d9
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 1 long base64-like blob(s).
font_00_cff_off00011c74.bin pdf-font-stream PDF embedded font (cff) at offset 0x11C74 5675 bytes
SHA-256: e66c939a81f8c9e7598f5e60c3e8da98458e028e8d780e52aa2c66ee561f0c9e
font_01_cff_off00012f89.bin pdf-font-stream PDF embedded font (cff) at offset 0x12F89 711 bytes
SHA-256: 3d33962dd4a6f22f01a79a59d7e354946f3449ee44f842901289bf69d34f7b68
font_02_cff_off00013280.bin pdf-font-stream PDF embedded font (cff) at offset 0x13280 2346 bytes
SHA-256: 41a220c501cf7e8d1d0c247c4da7eaeba0b02d349cb41836f8e76fe05cd7dd84
font_03_cff_off00013b2a.bin pdf-font-stream PDF embedded font (cff) at offset 0x13B2A 4956 bytes
SHA-256: ef9961b4010c7605363674aaacdfbee415bab66d697008cebbb1a9af57d8acfc
font_04_cff_off00014bc3.bin pdf-font-stream PDF embedded font (cff) at offset 0x14BC3 2523 bytes
SHA-256: fd3489fd63095cd02cf1fab683ff19c5c317fad0b9591682f1af7035af9475e2
font_05_cff_off000154e5.bin pdf-font-stream PDF embedded font (cff) at offset 0x154E5 4294 bytes
SHA-256: 706d3ec8f1c57c6e741897a6d8d58fb9d49284507bc8fdad1320ec8f96eceb91

Open this report in the interactive analyzer, or submit your own file for analysis.