PDF malware analysis — malicious · 812737a08d8a07ab

MALICIOUS

PDF

28.9 KB First seen: 2026-06-10

MD5: ea717efeb921ef066650accacb951cd8 SHA-1: 14f6b6d85b0a707dd4c2edc3cbe064532309872a SHA-256: 812737a08d8a07abac309492d7cc50803d920ce3fb7a0d3cfb56276181a93366

64 Risk Score

Machine Learning

Nyx PDF Classifier clean score 0.0387

Heuristics 4

PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 28 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://forms.zohopublic.com/filedshared/form/KeystonePacificPropertyManagementLLC/formperma/Z_lzXWEH4amf4WtOhP2Bg8Yk4bgU8x6iodKYQcRcsNI PDF link annotation

Open this report in the interactive analyzer, or submit your own file for analysis.