Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c79f54b9f89e7ce…

MALICIOUS

PDF

1.28 MB Authoring application: Skia/PDF m150 Google Docs Renderer First seen: 2026-05-19
MD5: 93c8a7f0b6a90281ee6e8cee900deb17 SHA-1: b8ad7e9b9d05d1cc5ff8ccc5b1e9d948696ad550 SHA-256: 7c79f54b9f89e7ced29ac52a19fb0cf5b3d449fd841fbaf9ae6a5e506bb8cb32
84 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0002

Heuristics 4

  • Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINK
    Document uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://1ed2crl43-qbi2420dv0gnlmaf.hop.clickbank.net PDF link annotation
    • https://1ed2crl43-qbi2420dv0gnlmaf.hop.clickPDF link annotation
🗂 Part of campaign: shared payload 26997eaaa5 77 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 14

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000145f2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x145F2 37824 bytes
SHA-256: ff0d89bc12853b8cd687ed0f5e044af4d3a7f701de26c44af0781236010ac32f
stream_005_off00019da6.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x19DA6 367476 bytes
SHA-256: 7d481e98fdf9a7c6624e1e41b5877cabb14f2c188dfcb75c076751020cfce546
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Static shellcode analysis found candidate code region(s). Indicators: NOP sled
stream_008_off00038ea4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x38EA4 320016 bytes
SHA-256: 4393e5df90ad272f84c8a964a6e7f932cce0a0ea64155fea96ed61db161dd199
stream_017_off00063f0a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x63F0A 344424 bytes
SHA-256: c31afb66d462213dd0ede8e4979b8dfd581b746f30939e7e0bac585b7ff93021
stream_020_off0007c1d5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7C1D5 348492 bytes
SHA-256: e8178553ca168d32750908f2f9cd99b4fe8ace87c20bc093ff297a19a09112b3
stream_023_off000938f5.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x938F5 878688 bytes
SHA-256: 20967d5a89056acb2d02270af237287619415768bba5f96ed140d4a04686494d
stream_049_off0013e47c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x13E47C 27584 bytes
SHA-256: 7aa1202e99ba6abb293a7034ac01f527040e519510427f318cc30177ccf450ab
icc_00_off000001d5.icc pdf-icc-profile PDF ICC profile at offset 0x1D5 536 bytes
SHA-256: d9f822e8083f2f4d1c91e887454be5f75e8c7144b2853408f361e3c4a7a6b36d
font_00_sfnt_off00128bba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x128BBA 32296 bytes
SHA-256: dba378716be45e44a703fedb54b15f54c84d2ee40b480ce096b8c8be13812f07
font_01_sfnt_off0012dc98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12DC98 46264 bytes
SHA-256: 49471fe61a813257508f1d1933eb127cb4798ceb380a59c775bb2cf7a42fb11c
font_02_sfnt_off00135385.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x135385 25628 bytes
SHA-256: 0d38b973486f1835bf6736bad3cd8b6e9ea878d56d798fd2126c83cf5ba80aa4
font_03_sfnt_off0013a9e2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A9E2 24348 bytes
SHA-256: 65726fdd4a8a9cb81061e70cc8489c33f69cd13e6928b2191ef5befcc511baec
font_05_sfnt_off001425f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1425F0 129044 bytes
SHA-256: 0427677f1a6df17cab23c3c7a03ae3799dd2011c6cfc0a0b32a93047952fd98a
font_06_sfnt_off00143e3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143E3D 5652 bytes
SHA-256: c7c7eb976f392d5878559816cd85668415386683f4ad8ac6c227bd3449cc4b83

Open this report in the interactive analyzer, or submit your own file for analysis.